3v4l.org

run code in 300+ PHP versions simultaneously
<?php declare(strict_types=1); class Escaper { protected $encoding; public function __construct(string $encoding) { $this->encoding = $encoding; } public function js(string $input) : string { // json_encode can only accept UTF-8 encoded strings. if ($this->encoding !== 'UTF-8') { $input = mb_convert_encoding($input, 'UTF-8', $this->encoding); } $json = json_encode($input, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); if (!$json) { return ''; } $json = trim($json, '"'); // Convert back from UTF-8 if necessary. if ($this->encoding !== 'UTF-8') { //try { $json = mb_convert_encoding($json, $this->encoding, 'UTF-8'); //} catch (Error $e) { // echo 'ERROR CAUGHT. ENCODING: ' . $this->encoding; // return ''; //} } return $json; } } $malicious = 'alert("foo");</script>'; $malicious = 'test'; $utf = new Escaper('UTF-8'); $iso = new Escaper('ISO-8859-1'); echo $utf->js($malicious); echo "\n"; echo $iso->js($malicious); echo "\n"; foreach (mb_list_encodings() as $encoding) { $e = new Escaper($encoding); echo $e->js($malicious); echo ' (' . $encoding . ')'; echo "\n"; } /* mb_internal_encoding('ArmSCII-8'); mb_http_output('ArmSCII-8'); $e = new Escaper('ArmSCII-8'); echo $e->js($malicious); */
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 23, Position 2 = 37
Branch analysis from position: 23
2 jumps found. (Code = 78) Position 1 = 24, Position 2 = 37
Branch analysis from position: 24
1 jumps found. (Code = 42) Position 1 = 23
Branch analysis from position: 23
Branch analysis from position: 37
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 37
filename:       /in/l99ga
function name:  (null)
number of ops:  39
compiled vars:  !0 = $malicious, !1 = $utf, !2 = $iso, !3 = $encoding, !4 = $e
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   41     0  E >   ASSIGN                                                   !0, 'alert%28%22foo%22%29%3B%3C%2Fscript%3E'
   42     1        ASSIGN                                                   !0, 'test'
   44     2        NEW                                              $7      'Escaper'
          3        SEND_VAL_EX                                              'UTF-8'
          4        DO_FCALL                                      0          
          5        ASSIGN                                                   !1, $7
   45     6        NEW                                              $10     'Escaper'
          7        SEND_VAL_EX                                              'ISO-8859-1'
          8        DO_FCALL                                      0          
          9        ASSIGN                                                   !2, $10
   47    10        INIT_METHOD_CALL                                         !1, 'js'
         11        SEND_VAR_EX                                              !0
         12        DO_FCALL                                      0  $13     
         13        ECHO                                                     $13
   48    14        ECHO                                                     '%0A'
   50    15        INIT_METHOD_CALL                                         !2, 'js'
         16        SEND_VAR_EX                                              !0
         17        DO_FCALL                                      0  $14     
         18        ECHO                                                     $14
   51    19        ECHO                                                     '%0A'
   53    20        INIT_FCALL                                               'mb_list_encodings'
         21        DO_ICALL                                         $15     
         22      > FE_RESET_R                                       $16     $15, ->37
         23    > > FE_FETCH_R                                               $16, !3, ->37
   54    24    >   NEW                                              $17     'Escaper'
         25        SEND_VAR_EX                                              !3
         26        DO_FCALL                                      0          
         27        ASSIGN                                                   !4, $17
   55    28        INIT_METHOD_CALL                                         !4, 'js'
         29        SEND_VAR_EX                                              !0
         30        DO_FCALL                                      0  $20     
         31        ECHO                                                     $20
   56    32        CONCAT                                           ~21     '+%28', !3
         33        CONCAT                                           ~22     ~21, '%29'
         34        ECHO                                                     ~22
   57    35        ECHO                                                     '%0A'
   53    36      > JMP                                                      ->23
         37    >   FE_FREE                                                  $16
   65    38      > RETURN                                                   1

Class Escaper:
Function __construct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/l99ga
function name:  __construct
number of ops:  4
compiled vars:  !0 = $encoding
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    8     0  E >   RECV                                             !0      
   10     1        ASSIGN_OBJ                                               'encoding'
          2        OP_DATA                                                  !0
   11     3      > RETURN                                                   null

End of function __construct

Function js:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 4, Position 2 = 11
Branch analysis from position: 4
2 jumps found. (Code = 43) Position 1 = 18, Position 2 = 19
Branch analysis from position: 18
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 19
2 jumps found. (Code = 43) Position 1 = 27, Position 2 = 34
Branch analysis from position: 27
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 34
Branch analysis from position: 11
filename:       /in/l99ga
function name:  js
number of ops:  38
compiled vars:  !0 = $input, !1 = $json
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   13     0  E >   RECV                                             !0      
   16     1        FETCH_OBJ_R                                      ~2      'encoding'
          2        IS_NOT_IDENTICAL                                         ~2, 'UTF-8'
          3      > JMPZ                                                     ~3, ->11
   17     4    >   INIT_FCALL                                               'mb_convert_encoding'
          5        SEND_VAR                                                 !0
          6        SEND_VAL                                                 'UTF-8'
          7        FETCH_OBJ_R                                      ~4      'encoding'
          8        SEND_VAL                                                 ~4
          9        DO_ICALL                                         $5      
         10        ASSIGN                                                   !0, $5
   20    11    >   INIT_FCALL                                               'json_encode'
         12        SEND_VAR                                                 !0
         13        SEND_VAL                                                 15
         14        DO_ICALL                                         $7      
         15        ASSIGN                                                   !1, $7
   21    16        BOOL_NOT                                         ~9      !1
         17      > JMPZ                                                     ~9, ->19
   22    18    > > RETURN                                                   ''
   25    19    >   INIT_FCALL                                               'trim'
         20        SEND_VAR                                                 !1
         21        SEND_VAL                                                 '%22'
         22        DO_ICALL                                         $10     
         23        ASSIGN                                                   !1, $10
   28    24        FETCH_OBJ_R                                      ~12     'encoding'
         25        IS_NOT_IDENTICAL                                         ~12, 'UTF-8'
         26      > JMPZ                                                     ~13, ->34
   30    27    >   INIT_FCALL                                               'mb_convert_encoding'
         28        SEND_VAR                                                 !1
         29        FETCH_OBJ_R                                      ~14     'encoding'
         30        SEND_VAL                                                 ~14
         31        SEND_VAL                                                 'UTF-8'
         32        DO_ICALL                                         $15     
         33        ASSIGN                                                   !1, $15
   37    34    >   VERIFY_RETURN_TYPE                                       !1
         35      > RETURN                                                   !1
   38    36*       VERIFY_RETURN_TYPE                                       
         37*     > RETURN                                                   null

End of function js

End of class Escaper.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
176.55 ms | 1445 KiB | 17 Q