3v4l.org

run code in 300+ PHP versions simultaneously

@ 2024-04-23T23:23:22Z

<?php
$xml = <<<XML
<!DOCTYPE root [
    <!ENTITY attack SYSTEM "config/config.ini">
    <!ENTITY ent SYSTEM "entities/ent.txt">
]>
<xml>
    &attack;
    &ent;
</xml>
XML;

// emulate existing local file
mkdir('/tmp/entities/');
file_put_contents('/tmp/entities/ent.txt', 'OK ENTITY');

libxml_set_external_entity_loader(
    function (?string $public, ?string $system, array $context) {
        $path = realpath('/tmp' . $system);
        if ($public === null && $path !== null && str_starts_with($path, '/tmp/entities/')) {
            $resolved = file_get_contents('/tmp' . $system);
        } else {
            $resolved = 'nice try but no';
        }
        $f = fopen('php://temp', 'r+');
        fwrite($f, $resolved);
        rewind($f);
        return $f;
    }
);

$doc = new DOMDocument;
$doc->loadXML($xml, LIBXML_NOENT);
echo $doc->saveXML();
?>

Output for git.master, git.master_jit, rfc.property-hooks: <?xml version="1.0"?> <!DOCTYPE root [ <!ENTITY attack SYSTEM "config/config.ini"> <!ENTITY ent SYSTEM "entities/ent.txt"> ]> <xml> nice try but no OK ENTITY </xml>

This tab shows result from various feature-branches currently under review by the php developers. Contact me to have additional branches featured.

Active branches

Archived branches

Once feature-branches are merged or declined, they are no longer available. Their functionality (when merged) can be viewed from the main output page

2020-03-21 RFC: Is_Literal - declined
2020-12-04 Enumerations - included in PHP 8.1
2018-06-15 Typed Properties v2 - implemented in PHP 7.4
2016-08-12 Object typehint - included in PHP 7.2
2016-08-14 Arrow functions - withdrawn
2016-05-29 array_change_keys() - withdrawn
2016-04-19 Lexical scope support for anonymous classes - suspended
2016-04-17 Functional Interfaces - declined
2016-03-16 Typed Properties - superseded in favor of Typed Properties 2.0
2015-08-27 Callable Prototypes - declined
2015-05-01 Short Closures - declined / withdrawn in favor of Arrow Functions
2015-02-18 Scalar type hints v5 - included in PHP 7
2015-02-14 Union Types - declined
2013-09-22 Anonymous classes - included in PHP 7

preferences:dark modelive preview

18.03 ms | 405 KiB | 5 Q