3v4l.org

run code in 300+ PHP versions simultaneously
<?php // This code is vulnerable when cmd == 1 and text contains a script // ?cmd=1&text=%3Cscript%3Ewindow.location%20=%20%22http://www.google.com/%22%3C/script%3E function get($c){ if ($c == 1) return $_GET['text']; else return htmlspecialchars($_GET['text']); } $cmd = (int) $_GET["cmd"]; if ($cmd == 0) echo "0"; else echo ($cmd . " " . get($cmd)); ?>
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 6, Position 2 = 8
Branch analysis from position: 6
1 jumps found. (Code = 42) Position 1 = 14
Branch analysis from position: 14
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 8
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/oVU3U
function name:  (null)
number of ops:  15
compiled vars:  !0 = $cmd
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   10     0  E >   FETCH_R                      global              ~1      '_GET'
          1        FETCH_DIM_R                                      ~2      ~1, 'cmd'
          2        CAST                                          4  ~3      ~2
          3        ASSIGN                                                   !0, ~3
   12     4        IS_EQUAL                                                 !0, 0
          5      > JMPZ                                                     ~5, ->8
          6    >   ECHO                                                     '0'
          7      > JMP                                                      ->14
   13     8    >   CONCAT                                           ~6      !0, '+'
          9        INIT_FCALL                                               'get'
         10        SEND_VAR                                                 !0
         11        DO_FCALL                                      0  $7      
         12        CONCAT                                           ~8      ~6, $7
         13        ECHO                                                     ~8
   15    14    > > RETURN                                                   1

Function get:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 3, Position 2 = 7
Branch analysis from position: 3
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 7
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/oVU3U
function name:  get
number of ops:  14
compiled vars:  !0 = $c
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    5     0  E >   RECV                                             !0      
    6     1        IS_EQUAL                                                 !0, 1
          2      > JMPZ                                                     ~1, ->7
          3    >   FETCH_R                      global              ~2      '_GET'
          4        FETCH_DIM_R                                      ~3      ~2, 'text'
          5      > RETURN                                                   ~3
          6*       JMP                                                      ->13
    7     7    >   INIT_FCALL                                               'htmlspecialchars'
          8        FETCH_R                      global              ~4      '_GET'
          9        FETCH_DIM_R                                      ~5      ~4, 'text'
         10        SEND_VAL                                                 ~5
         11        DO_ICALL                                         $6      
         12      > RETURN                                                   $6
    8    13*     > RETURN                                                   null

End of function get

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
153.41 ms | 1399 KiB | 16 Q