3v4l.org

run code in 300+ PHP versions simultaneously
<?php $argv = array(null, "' OR 1=1--", 'root'); echo "<!doctype html>\n"; $username = @$_GET['username'] ? $_GET['username'] : $argv[1]; $password = @$_GET['password'] ? $_GET['password'] : $argv[2]; $password = md5($password); $pdo = new PDO('sqlite::memory:'); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $pdo->exec("DROP TABLE IF EXISTS users"); $pdo->exec("CREATE TABLE users (username VARCHAR(255), password VARCHAR(255))"); $rootPassword = md5("secret"); $pdo->exec("INSERT INTO users (username, password) VALUES ('root', '$rootPassword');"); echo $q = "SELECT * FROM users WHERE username = ? AND password = ?"; $statement = $pdo->prepare($q); $statement->execute(array($username, $password)); if (count($statement->fetchAll())) { echo "<br>\nAccess granted to $username!<br>\n"; } else { echo "<br>\nAccess denied for $username!<br>\n"; }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 7, Position 2 = 11
Branch analysis from position: 7
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 23
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 25
Branch analysis from position: 25
2 jumps found. (Code = 43) Position 1 = 69, Position 2 = 74
Branch analysis from position: 69
1 jumps found. (Code = 42) Position 1 = 78
Branch analysis from position: 78
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 74
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 23
2 jumps found. (Code = 43) Position 1 = 69, Position 2 = 74
Branch analysis from position: 69
Branch analysis from position: 74
Branch analysis from position: 11
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 23
Branch analysis from position: 19
Branch analysis from position: 23
filename:       /in/UeV4s
function name:  (null)
number of ops:  79
compiled vars:  !0 = $argv, !1 = $username, !2 = $password, !3 = $pdo, !4 = $rootPassword, !5 = $q, !6 = $statement
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, <array>
    3     1        ECHO                                                     '%3C%21doctype+html%3E%0A'
    4     2        BEGIN_SILENCE                                    ~8      
          3        FETCH_R                      global              ~9      '_GET'
          4        FETCH_DIM_R                                      ~10     ~9, 'username'
          5        END_SILENCE                                              ~8
          6      > JMPZ                                                     ~10, ->11
          7    >   FETCH_R                      global              ~11     '_GET'
          8        FETCH_DIM_R                                      ~12     ~11, 'username'
          9        QM_ASSIGN                                        ~13     ~12
         10      > JMP                                                      ->13
         11    >   FETCH_DIM_R                                      ~14     !0, 1
         12        QM_ASSIGN                                        ~13     ~14
         13    >   ASSIGN                                                   !1, ~13
    5    14        BEGIN_SILENCE                                    ~16     
         15        FETCH_R                      global              ~17     '_GET'
         16        FETCH_DIM_R                                      ~18     ~17, 'password'
         17        END_SILENCE                                              ~16
         18      > JMPZ                                                     ~18, ->23
         19    >   FETCH_R                      global              ~19     '_GET'
         20        FETCH_DIM_R                                      ~20     ~19, 'password'
         21        QM_ASSIGN                                        ~21     ~20
         22      > JMP                                                      ->25
         23    >   FETCH_DIM_R                                      ~22     !0, 2
         24        QM_ASSIGN                                        ~21     ~22
         25    >   ASSIGN                                                   !2, ~21
    6    26        INIT_FCALL                                               'md5'
         27        SEND_VAR                                                 !2
         28        DO_ICALL                                         $24     
         29        ASSIGN                                                   !2, $24
    7    30        NEW                                              $26     'PDO'
         31        SEND_VAL_EX                                              'sqlite%3A%3Amemory%3A'
         32        DO_FCALL                                      0          
         33        ASSIGN                                                   !3, $26
    8    34        INIT_METHOD_CALL                                         !3, 'setAttribute'
         35        SEND_VAL_EX                                              3
         36        SEND_VAL_EX                                              2
         37        DO_FCALL                                      0          
    9    38        INIT_METHOD_CALL                                         !3, 'exec'
         39        SEND_VAL_EX                                              'DROP+TABLE+IF+EXISTS+users'
         40        DO_FCALL                                      0          
   10    41        INIT_METHOD_CALL                                         !3, 'exec'
         42        SEND_VAL_EX                                              'CREATE+TABLE+users+%28username+VARCHAR%28255%29%2C+password+VARCHAR%28255%29%29'
         43        DO_FCALL                                      0          
   11    44        INIT_FCALL                                               'md5'
         45        SEND_VAL                                                 'secret'
         46        DO_ICALL                                         $32     
         47        ASSIGN                                                   !4, $32
   12    48        INIT_METHOD_CALL                                         !3, 'exec'
         49        ROPE_INIT                                     3  ~35     'INSERT+INTO+users+%28username%2C+password%29+VALUES+%28%27root%27%2C+%27'
         50        ROPE_ADD                                      1  ~35     ~35, !4
         51        ROPE_END                                      2  ~34     ~35, '%27%29%3B'
         52        SEND_VAL_EX                                              ~34
         53        DO_FCALL                                      0          
   13    54        ASSIGN                                           ~38     !5, 'SELECT+%2A+FROM+users+WHERE+username+%3D+%3F+AND+password+%3D+%3F'
         55        ECHO                                                     ~38
   14    56        INIT_METHOD_CALL                                         !3, 'prepare'
         57        SEND_VAR_EX                                              !5
         58        DO_FCALL                                      0  $39     
         59        ASSIGN                                                   !6, $39
   15    60        INIT_METHOD_CALL                                         !6, 'execute'
         61        INIT_ARRAY                                       ~41     !1
         62        ADD_ARRAY_ELEMENT                                ~41     !2
         63        SEND_VAL_EX                                              ~41
         64        DO_FCALL                                      0          
   16    65        INIT_METHOD_CALL                                         !6, 'fetchAll'
         66        DO_FCALL                                      0  $43     
         67        COUNT                                            ~44     $43
         68      > JMPZ                                                     ~44, ->74
   17    69    >   ROPE_INIT                                     3  ~46     '%3Cbr%3E%0AAccess+granted+to+'
         70        ROPE_ADD                                      1  ~46     ~46, !1
         71        ROPE_END                                      2  ~45     ~46, '%21%3Cbr%3E%0A'
         72        ECHO                                                     ~45
         73      > JMP                                                      ->78
   19    74    >   ROPE_INIT                                     3  ~49     '%3Cbr%3E%0AAccess+denied+for+'
         75        ROPE_ADD                                      1  ~49     ~49, !1
         76        ROPE_END                                      2  ~48     ~49, '%21%3Cbr%3E%0A'
         77        ECHO                                                     ~48
   20    78    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
166.53 ms | 1404 KiB | 15 Q