3v4l.org

run code in 300+ PHP versions simultaneously
<?php $string = '<img src="{{ a }}" />'; $payload = '" onload="alert(\'XSS!\');"'; var_dump( str_replace( '{{ a }}', htmlentities($payload, ENT_QUOTES | ENT_HTML5, 'UTF-8'), $string ) ); var_dump( str_replace( '{{ a }}', "/somefile.php?".http_build_query(array('url' => $payload)), $string ) ); var_dump( str_replace( '{{ a }}', urlencode($payload), $string ) );
Output for git.master, git.master_jit, rfc.property-hooks
string(91) "<img src="&quot; onload&equals;&quot;alert&lpar;&apos;XSS&excl;&apos;&rpar;&semi;&quot;" />" string(77) "<img src="/somefile.php?url=%22+onload%3D%22alert%28%27XSS%21%27%29%3B%22" />" string(59) "<img src="%22+onload%3D%22alert%28%27XSS%21%27%29%3B%22" />"

This tab shows result from various feature-branches currently under review by the php developers. Contact me to have additional branches featured.

Active branches

Archived branches

Once feature-branches are merged or declined, they are no longer available. Their functionality (when merged) can be viewed from the main output page

preferences:
28.96 ms | 406 KiB | 5 Q