3v4l.org

run code in 500+ PHP versions simultaneously
<?php declare(strict_types=1); /** * Verify a Django password (PBKDF2-SHA256) * * @param string $password The password provided by the user * @param string $djangoHash The hash stored in the Django app * @return bool * @throws Exception */ function django_password_verify(string $password, string $djangoHash): bool { $pieces = explode('$', $djangoHash); if (count($pieces) !== 4) { throw new Exception("Illegal hash format"); } list($header, $iter, $salt, $hash) = $pieces; // Get the hash algorithm used: if (preg_match('#^pbkdf2_([a-z0-9A-Z]+)$#', $header, $m)) { $algo = $m[1]; } else { throw new Exception(sprintf("Bad header (%s)", $header)); } if (!in_array($algo, hash_algos())) { throw new Exception(sprintf("Illegal hash algorithm (%s)", $algo)); } $calc = hash_pbkdf2( $algo, $password, $salt, (int) $iter, 32, true ); return hash_equals($calc, base64_decode($hash)); } var_dump( django_password_verify( '123', 'pbkdf2_sha256$20000$MflWfLXbejfO$tNrjk42YE9ZXkg7IvXY5fikbC+H52Ipd2mf7m0azttk=' ) ); var_dump( django_password_verify( 'password', 'pbkdf2_sha256$20000$MflWfLXbejfO$tNrjk42YE9ZXkg7IvXY5fikbC+H52Ipd2mf7m0azttk=' ) );
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/WbTpW
function name:  (null)
number of ops:  15
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   40     0  E >   INIT_FCALL                                                   'var_dump'
   41     1        INIT_FCALL                                                   'django_password_verify'
   42     2        SEND_VAL                                                     '123'
   43     3        SEND_VAL                                                     'pbkdf2_sha256%2420000%24MflWfLXbejfO%24tNrjk42YE9ZXkg7IvXY5fikbC%2BH52Ipd2mf7m0azttk%3D'
   41     4        DO_FCALL                                          0  $0      
   43     5        SEND_VAR                                                     $0
   40     6        DO_ICALL                                                     
   46     7        INIT_FCALL                                                   'var_dump'
   47     8        INIT_FCALL                                                   'django_password_verify'
   48     9        SEND_VAL                                                     'password'
   49    10        SEND_VAL                                                     'pbkdf2_sha256%2420000%24MflWfLXbejfO%24tNrjk42YE9ZXkg7IvXY5fikbC%2BH52Ipd2mf7m0azttk%3D'
   47    11        DO_FCALL                                          0  $2      
   49    12        SEND_VAR                                                     $2
   46    13        DO_ICALL                                                     
   51    14      > RETURN                                                       1

Function django_password_verify:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 10, Position 2 = 14
Branch analysis from position: 10
1 jumps found. (Code = 108) Position 1 = -2
Branch analysis from position: 14
2 jumps found. (Code = 43) Position 1 = 30, Position 2 = 33
Branch analysis from position: 30
1 jumps found. (Code = 42) Position 1 = 40
Branch analysis from position: 40
2 jumps found. (Code = 43) Position 1 = 45, Position 2 = 52
Branch analysis from position: 45
1 jumps found. (Code = 108) Position 1 = -2
Branch analysis from position: 52
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 33
1 jumps found. (Code = 108) Position 1 = -2
filename:       /in/WbTpW
function name:  django_password_verify
number of ops:  73
compiled vars:  !0 = $password, !1 = $djangoHash, !2 = $pieces, !3 = $header, !4 = $iter, !5 = $salt, !6 = $hash, !7 = $m, !8 = $algo, !9 = $calc
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   12     0  E >   RECV                                                 !0      
          1        RECV                                                 !1      
   14     2        INIT_FCALL                                                   'explode'
          3        SEND_VAL                                                     '%24'
          4        SEND_VAR                                                     !1
          5        DO_ICALL                                             $10     
          6        ASSIGN                                                       !2, $10
   15     7        COUNT                                                ~12     !2
          8        IS_NOT_IDENTICAL                                             ~12, 4
          9      > JMPZ                                                         ~13, ->14
   16    10    >   NEW                                                  $14     'Exception'
         11        SEND_VAL_EX                                                  'Illegal+hash+format'
         12        DO_FCALL                                          0          
         13      > THROW                                             0          $14
   18    14    >   QM_ASSIGN                                            ~16     !2
         15        FETCH_LIST_R                                         $17     ~16, 0
         16        ASSIGN                                                       !3, $17
         17        FETCH_LIST_R                                         $19     ~16, 1
         18        ASSIGN                                                       !4, $19
         19        FETCH_LIST_R                                         $21     ~16, 2
         20        ASSIGN                                                       !5, $21
         21        FETCH_LIST_R                                         $23     ~16, 3
         22        ASSIGN                                                       !6, $23
         23        FREE                                                         ~16
   20    24        INIT_FCALL                                                   'preg_match'
         25        SEND_VAL                                                     '%23%5Epbkdf2_%28%5Ba-z0-9A-Z%5D%2B%29%24%23'
         26        SEND_VAR                                                     !3
         27        SEND_REF                                                     !7
         28        DO_ICALL                                             $25     
         29      > JMPZ                                                         $25, ->33
   21    30    >   FETCH_DIM_R                                          ~26     !7, 1
         31        ASSIGN                                                       !8, ~26
   20    32      > JMP                                                          ->40
   23    33    >   NEW                                                  $28     'Exception'
         34        ROPE_INIT                                         3  ~30     'Bad+header+%28'
         35        ROPE_ADD                                          1  ~30     ~30, !3
         36        ROPE_END                                          2  ~29     ~30, '%29'
         37        SEND_VAL_EX                                                  ~29
         38        DO_FCALL                                          0          
         39      > THROW                                             0          $28
   25    40    >   INIT_FCALL                                                   'hash_algos'
         41        DO_ICALL                                             $33     
         42        FRAMELESS_ICALL_2                in_array            ~34     !8, $33
         43        BOOL_NOT                                             ~35     ~34
         44      > JMPZ                                                         ~35, ->52
   26    45    >   NEW                                                  $36     'Exception'
         46        ROPE_INIT                                         3  ~38     'Illegal+hash+algorithm+%28'
         47        ROPE_ADD                                          1  ~38     ~38, !8
         48        ROPE_END                                          2  ~37     ~38, '%29'
         49        SEND_VAL_EX                                                  ~37
         50        DO_FCALL                                          0          
         51      > THROW                                             0          $36
   29    52    >   INIT_FCALL                                                   'hash_pbkdf2'
   30    53        SEND_VAR                                                     !8
   31    54        SEND_VAR                                                     !0
   32    55        SEND_VAR                                                     !5
   33    56        CAST                                              4  ~41     !4
         57        SEND_VAL                                                     ~41
   34    58        SEND_VAL                                                     32
   35    59        SEND_VAL                                                     <true>
   29    60        DO_ICALL                                             $42     
         61        ASSIGN                                                       !9, $42
   37    62        INIT_FCALL                                                   'hash_equals'
         63        SEND_VAR                                                     !9
         64        INIT_FCALL                                                   'base64_decode'
         65        SEND_VAR                                                     !6
         66        DO_ICALL                                             $44     
         67        SEND_VAR                                                     $44
         68        DO_ICALL                                             $45     
         69        VERIFY_RETURN_TYPE                                           $45
         70      > RETURN                                                       $45
   38    71*       VERIFY_RETURN_TYPE                                           
         72*     > RETURN                                                       null

End of function django_password_verify

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
211.17 ms | 2604 KiB | 22 Q