3v4l.org

run code in 300+ PHP versions simultaneously

sponsor
bughunt
search
recent
about

@ 2019-08-14T04:05:24Z

<?php

class foo {
    public function __wakeup() {
        echo 'exploited';
    }
}


$userInput = serialize(new foo);
echo $userInput;
$serialisedStr = serialize([
    $userInput,
]);
unserialize($serialisedStr);

Output
Performance
VLD
References
Branches

unserialize: documentation ( source)
serialize: documentation ( source)

preferences:dark modelive preview

60.43 ms | 402 KiB | 5 Q