3v4l.org

run code in 300+ PHP versions simultaneously
<?php // Challenge: make this terrible code safe // echo "<!doctype html>\n"; $username = @$_GET['username'] ? $_GET['username'] : $argv[1]; $password = @$_GET['password'] ? $_GET['password'] : $argv[2]; $password = md5($password); $pdo = new PDO('sqlite::memory:'); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $pdo->exec("DROP TABLE IF EXISTS users"); $pdo->exec("CREATE TABLE users (username VARCHAR(255), password VARCHAR(255))"); $rootPassword = md5("secret"); $pdo->exec("INSERT INTO users (username, password) VALUES ('root', '$rootPassword');"); $statement = $pdo->query("SELECT * FROM users WHERE username = '$username' AND password = '$password'"); if (count($statement->fetchAll())) { echo "Access granted to $username!<br>\n"; } else { echo "Access denied for $username!<br>\n"; }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 5, Position 2 = 9
Branch analysis from position: 5
1 jumps found. (Code = 42) Position 1 = 11
Branch analysis from position: 11
2 jumps found. (Code = 43) Position 1 = 17, Position 2 = 21
Branch analysis from position: 17
1 jumps found. (Code = 42) Position 1 = 23
Branch analysis from position: 23
2 jumps found. (Code = 43) Position 1 = 65, Position 2 = 70
Branch analysis from position: 65
1 jumps found. (Code = 42) Position 1 = 74
Branch analysis from position: 74
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 70
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 21
2 jumps found. (Code = 43) Position 1 = 65, Position 2 = 70
Branch analysis from position: 65
Branch analysis from position: 70
Branch analysis from position: 9
2 jumps found. (Code = 43) Position 1 = 17, Position 2 = 21
Branch analysis from position: 17
Branch analysis from position: 21
filename:       /in/egQJu
function name:  (null)
number of ops:  75
compiled vars:  !0 = $username, !1 = $argv, !2 = $password, !3 = $pdo, !4 = $rootPassword, !5 = $statement
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    7     0  E >   BEGIN_SILENCE                                    ~6      
          1        FETCH_R                      global              ~7      '_GET'
          2        FETCH_DIM_R                                      ~8      ~7, 'username'
          3        END_SILENCE                                              ~6
          4      > JMPZ                                                     ~8, ->9
          5    >   FETCH_R                      global              ~9      '_GET'
          6        FETCH_DIM_R                                      ~10     ~9, 'username'
          7        QM_ASSIGN                                        ~11     ~10
          8      > JMP                                                      ->11
          9    >   FETCH_DIM_R                                      ~12     !1, 1
         10        QM_ASSIGN                                        ~11     ~12
         11    >   ASSIGN                                                   !0, ~11
    8    12        BEGIN_SILENCE                                    ~14     
         13        FETCH_R                      global              ~15     '_GET'
         14        FETCH_DIM_R                                      ~16     ~15, 'password'
         15        END_SILENCE                                              ~14
         16      > JMPZ                                                     ~16, ->21
         17    >   FETCH_R                      global              ~17     '_GET'
         18        FETCH_DIM_R                                      ~18     ~17, 'password'
         19        QM_ASSIGN                                        ~19     ~18
         20      > JMP                                                      ->23
         21    >   FETCH_DIM_R                                      ~20     !1, 2
         22        QM_ASSIGN                                        ~19     ~20
         23    >   ASSIGN                                                   !2, ~19
    9    24        INIT_FCALL                                               'md5'
         25        SEND_VAR                                                 !2
         26        DO_ICALL                                         $22     
         27        ASSIGN                                                   !2, $22
   11    28        NEW                                              $24     'PDO'
         29        SEND_VAL_EX                                              'sqlite%3A%3Amemory%3A'
         30        DO_FCALL                                      0          
         31        ASSIGN                                                   !3, $24
   12    32        INIT_METHOD_CALL                                         !3, 'setAttribute'
         33        SEND_VAL_EX                                              3
         34        SEND_VAL_EX                                              2
         35        DO_FCALL                                      0          
   14    36        INIT_METHOD_CALL                                         !3, 'exec'
         37        SEND_VAL_EX                                              'DROP+TABLE+IF+EXISTS+users'
         38        DO_FCALL                                      0          
   15    39        INIT_METHOD_CALL                                         !3, 'exec'
         40        SEND_VAL_EX                                              'CREATE+TABLE+users+%28username+VARCHAR%28255%29%2C+password+VARCHAR%28255%29%29'
         41        DO_FCALL                                      0          
   17    42        INIT_FCALL                                               'md5'
         43        SEND_VAL                                                 'secret'
         44        DO_ICALL                                         $30     
         45        ASSIGN                                                   !4, $30
   18    46        INIT_METHOD_CALL                                         !3, 'exec'
         47        ROPE_INIT                                     3  ~33     'INSERT+INTO+users+%28username%2C+password%29+VALUES+%28%27root%27%2C+%27'
         48        ROPE_ADD                                      1  ~33     ~33, !4
         49        ROPE_END                                      2  ~32     ~33, '%27%29%3B'
         50        SEND_VAL_EX                                              ~32
         51        DO_FCALL                                      0          
   20    52        INIT_METHOD_CALL                                         !3, 'query'
         53        ROPE_INIT                                     5  ~37     'SELECT+%2A+FROM+users+WHERE+username+%3D+%27'
         54        ROPE_ADD                                      1  ~37     ~37, !0
         55        ROPE_ADD                                      2  ~37     ~37, '%27+AND+password+%3D+%27'
         56        ROPE_ADD                                      3  ~37     ~37, !2
         57        ROPE_END                                      4  ~36     ~37, '%27'
         58        SEND_VAL_EX                                              ~36
         59        DO_FCALL                                      0  $40     
         60        ASSIGN                                                   !5, $40
   22    61        INIT_METHOD_CALL                                         !5, 'fetchAll'
         62        DO_FCALL                                      0  $42     
         63        COUNT                                            ~43     $42
         64      > JMPZ                                                     ~43, ->70
   23    65    >   ROPE_INIT                                     3  ~45     'Access+granted+to+'
         66        ROPE_ADD                                      1  ~45     ~45, !0
         67        ROPE_END                                      2  ~44     ~45, '%21%3Cbr%3E%0A'
         68        ECHO                                                     ~44
         69      > JMP                                                      ->74
   25    70    >   ROPE_INIT                                     3  ~48     'Access+denied+for+'
         71        ROPE_ADD                                      1  ~48     ~48, !0
         72        ROPE_END                                      2  ~47     ~48, '%21%3Cbr%3E%0A'
         73        ECHO                                                     ~47
   26    74    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
142.67 ms | 1400 KiB | 15 Q