3v4l.org

run code in 300+ PHP versions simultaneously
<?php $string = '<img src="{{ a }}" />'; $payload = '" onload="alert(\'XSS!\');"'; var_dump( str_replace( '{{ a }}', htmlentities($payload, ENT_QUOTES | ENT_HTML5, 'UTF-8'), $string ) ); var_dump( str_replace( '{{ a }}', "/somefile.php?".http_build_query(array('url' => $payload)), $string ) ); var_dump( str_replace( '{{ a }}', urlencode($payload), $string ) );
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/itUZX
function name:  (null)
number of ops:  40
compiled vars:  !0 = $string, !1 = $payload
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, '%3Cimg+src%3D%22%7B%7B+a+%7D%7D%22+%2F%3E'
    3     1        ASSIGN                                                   !1, '%22+onload%3D%22alert%28%27XSS%21%27%29%3B%22'
    5     2        INIT_FCALL                                               'var_dump'
    6     3        INIT_FCALL                                               'str_replace'
    7     4        SEND_VAL                                                 '%7B%7B+a+%7D%7D'
    8     5        INIT_FCALL                                               'htmlentities'
          6        SEND_VAR                                                 !1
          7        SEND_VAL                                                 51
          8        SEND_VAL                                                 'UTF-8'
          9        DO_ICALL                                         $4      
         10        SEND_VAR                                                 $4
    9    11        SEND_VAR                                                 !0
    6    12        DO_ICALL                                         $5      
    9    13        SEND_VAR                                                 $5
    5    14        DO_ICALL                                                 
   14    15        INIT_FCALL                                               'var_dump'
   15    16        INIT_FCALL                                               'str_replace'
   16    17        SEND_VAL                                                 '%7B%7B+a+%7D%7D'
   17    18        INIT_FCALL                                               'http_build_query'
         19        INIT_ARRAY                                       ~7      !1, 'url'
         20        SEND_VAL                                                 ~7
         21        DO_ICALL                                         $8      
         22        CONCAT                                           ~9      '%2Fsomefile.php%3F', $8
         23        SEND_VAL                                                 ~9
   18    24        SEND_VAR                                                 !0
   15    25        DO_ICALL                                         $10     
   18    26        SEND_VAR                                                 $10
   14    27        DO_ICALL                                                 
   22    28        INIT_FCALL                                               'var_dump'
   23    29        INIT_FCALL                                               'str_replace'
   24    30        SEND_VAL                                                 '%7B%7B+a+%7D%7D'
   25    31        INIT_FCALL                                               'urlencode'
         32        SEND_VAR                                                 !1
         33        DO_ICALL                                         $12     
         34        SEND_VAR                                                 $12
   26    35        SEND_VAR                                                 !0
   23    36        DO_ICALL                                         $13     
   26    37        SEND_VAR                                                 $13
   22    38        DO_ICALL                                                 
   28    39      > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
251.18 ms | 1010 KiB | 18 Q