3v4l.org

run code in 300+ PHP versions simultaneously
<?php declare(strict_types=1); /** * Verify a Django password (PBKDF2-SHA256) * * @param string $password The password provided by the user * @param string $djangoHash The hash stored in the Django app * @return bool * @throws Exception */ function django_password_verify(string $password, string $djangoHash): bool { $pieces = explode('$', $djangoHash); if (count($pieces) !== 4) { throw new Exception("Illegal hash format"); } list($header, $iter, $salt, $hash) = $pieces; // Get the hash algorithm used: if (preg_match('#^pbkdf2_([a-z0-9A-Z]+)$#', $header, $m)) { $algo = $m[1]; } else { throw new Exception(sprintf("Bad header (%s)", $header)); } if (!in_array($algo, hash_algos())) { throw new Exception(sprintf("Illegal hash algorithm (%s)", $algo)); } $calc = hash_pbkdf2( $algo, $password, $salt, (int) $iter, 32, true ); return hash_equals($calc, base64_decode($hash)); } var_dump( django_password_verify( '123', 'pbkdf2_sha256$20000$MflWfLXbejfO$tNrjk42YE9ZXkg7IvXY5fikbC+H52Ipd2mf7m0azttk=' ) ); var_dump( django_password_verify( 'password', 'pbkdf2_sha256$20000$MflWfLXbejfO$tNrjk42YE9ZXkg7IvXY5fikbC+H52Ipd2mf7m0azttk=' ) );
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/WbTpW
function name:  (null)
number of ops:  15
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   40     0  E >   INIT_FCALL                                               'var_dump'
   41     1        INIT_FCALL                                               'django_password_verify'
   42     2        SEND_VAL                                                 '123'
   43     3        SEND_VAL                                                 'pbkdf2_sha256%2420000%24MflWfLXbejfO%24tNrjk42YE9ZXkg7IvXY5fikbC%2BH52Ipd2mf7m0azttk%3D'
          4        DO_FCALL                                      0  $0      
          5        SEND_VAR                                                 $0
          6        DO_ICALL                                                 
   46     7        INIT_FCALL                                               'var_dump'
   47     8        INIT_FCALL                                               'django_password_verify'
   48     9        SEND_VAL                                                 'password'
   49    10        SEND_VAL                                                 'pbkdf2_sha256%2420000%24MflWfLXbejfO%24tNrjk42YE9ZXkg7IvXY5fikbC%2BH52Ipd2mf7m0azttk%3D'
         11        DO_FCALL                                      0  $2      
         12        SEND_VAR                                                 $2
         13        DO_ICALL                                                 
   51    14      > RETURN                                                   1

Function django_password_verify:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 10, Position 2 = 14
Branch analysis from position: 10
1 jumps found. (Code = 108) Position 1 = -2
Branch analysis from position: 14
2 jumps found. (Code = 43) Position 1 = 30, Position 2 = 33
Branch analysis from position: 30
1 jumps found. (Code = 42) Position 1 = 41
Branch analysis from position: 41
2 jumps found. (Code = 43) Position 1 = 49, Position 2 = 57
Branch analysis from position: 49
1 jumps found. (Code = 108) Position 1 = -2
Branch analysis from position: 57
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 33
1 jumps found. (Code = 108) Position 1 = -2
filename:       /in/WbTpW
function name:  django_password_verify
number of ops:  78
compiled vars:  !0 = $password, !1 = $djangoHash, !2 = $pieces, !3 = $header, !4 = $iter, !5 = $salt, !6 = $hash, !7 = $m, !8 = $algo, !9 = $calc
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   12     0  E >   RECV                                             !0      
          1        RECV                                             !1      
   14     2        INIT_FCALL                                               'explode'
          3        SEND_VAL                                                 '%24'
          4        SEND_VAR                                                 !1
          5        DO_ICALL                                         $10     
          6        ASSIGN                                                   !2, $10
   15     7        COUNT                                            ~12     !2
          8        IS_NOT_IDENTICAL                                         ~12, 4
          9      > JMPZ                                                     ~13, ->14
   16    10    >   NEW                                              $14     'Exception'
         11        SEND_VAL_EX                                              'Illegal+hash+format'
         12        DO_FCALL                                      0          
         13      > THROW                                         0          $14
   18    14    >   QM_ASSIGN                                        ~16     !2
         15        FETCH_LIST_R                                     $17     ~16, 0
         16        ASSIGN                                                   !3, $17
         17        FETCH_LIST_R                                     $19     ~16, 1
         18        ASSIGN                                                   !4, $19
         19        FETCH_LIST_R                                     $21     ~16, 2
         20        ASSIGN                                                   !5, $21
         21        FETCH_LIST_R                                     $23     ~16, 3
         22        ASSIGN                                                   !6, $23
         23        FREE                                                     ~16
   20    24        INIT_FCALL                                               'preg_match'
         25        SEND_VAL                                                 '%23%5Epbkdf2_%28%5Ba-z0-9A-Z%5D%2B%29%24%23'
         26        SEND_VAR                                                 !3
         27        SEND_REF                                                 !7
         28        DO_ICALL                                         $25     
         29      > JMPZ                                                     $25, ->33
   21    30    >   FETCH_DIM_R                                      ~26     !7, 1
         31        ASSIGN                                                   !8, ~26
         32      > JMP                                                      ->41
   23    33    >   NEW                                              $28     'Exception'
         34        INIT_FCALL                                               'sprintf'
         35        SEND_VAL                                                 'Bad+header+%28%25s%29'
         36        SEND_VAR                                                 !3
         37        DO_ICALL                                         $29     
         38        SEND_VAR_NO_REF_EX                                       $29
         39        DO_FCALL                                      0          
         40      > THROW                                         0          $28
   25    41    >   INIT_FCALL                                               'in_array'
         42        SEND_VAR                                                 !8
         43        INIT_FCALL                                               'hash_algos'
         44        DO_ICALL                                         $31     
         45        SEND_VAR                                                 $31
         46        DO_ICALL                                         $32     
         47        BOOL_NOT                                         ~33     $32
         48      > JMPZ                                                     ~33, ->57
   26    49    >   NEW                                              $34     'Exception'
         50        INIT_FCALL                                               'sprintf'
         51        SEND_VAL                                                 'Illegal+hash+algorithm+%28%25s%29'
         52        SEND_VAR                                                 !8
         53        DO_ICALL                                         $35     
         54        SEND_VAR_NO_REF_EX                                       $35
         55        DO_FCALL                                      0          
         56      > THROW                                         0          $34
   29    57    >   INIT_FCALL                                               'hash_pbkdf2'
   30    58        SEND_VAR                                                 !8
   31    59        SEND_VAR                                                 !0
   32    60        SEND_VAR                                                 !5
   33    61        CAST                                          4  ~37     !4
         62        SEND_VAL                                                 ~37
   34    63        SEND_VAL                                                 32
   35    64        SEND_VAL                                                 <true>
         65        DO_ICALL                                         $38     
   29    66        ASSIGN                                                   !9, $38
   37    67        INIT_FCALL                                               'hash_equals'
         68        SEND_VAR                                                 !9
         69        INIT_FCALL                                               'base64_decode'
         70        SEND_VAR                                                 !6
         71        DO_ICALL                                         $40     
         72        SEND_VAR                                                 $40
         73        DO_ICALL                                         $41     
         74        VERIFY_RETURN_TYPE                                       $41
         75      > RETURN                                                   $41
   38    76*       VERIFY_RETURN_TYPE                                       
         77*     > RETURN                                                   null

End of function django_password_verify

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
174.47 ms | 1407 KiB | 33 Q