3v4l.org

run code in 300+ PHP versions simultaneously
<?php ini_set('dsiplay_errors', 'On'); error_reporting(-1); $i = array( 'save' => '1.png', // valide input 'dt' => '../../1.png', // directory traversal (dt) 'dt_url_e' => urlencode('../../1.png'), // dt url-encoded 'dt_durl_e' => urlencode(urlencode('../../1.png')), // dt double url-encoded 'dt_utf8' => '..%c0%af..%c0%af1.png', // dt utf-8 encoded 'dt_url_d' => urldecode('../../1.png'), // dt url decoded 'dt_nb_d' => '../../1.png%00', // dt with null byte 'dt_nb' => '../../1.png ', // dt with space char ); foreach($i as $k=>$s) { echo '----------------------------------'."\n"; echo '** case: '.$k."\n\n"; fi($s); echo '----------------------------------'."\n\n"; } function fi($s) { $s_d = urldecode($s); $p = pathinfo($s); echo 'input: '.$s."\n"; echo 'input urldecoded: '.$s_d."\n"; echo 'realpath: '.realpath($s)."\n"; echo 'basename: '.basename($s)."\n"; echo 'realpath url-d: '.realpath($s_d)."\n"; echo 'basename url-d: '.basename($s_d)."\n"; var_dump($p); }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 29, Position 2 = 40
Branch analysis from position: 29
2 jumps found. (Code = 78) Position 1 = 30, Position 2 = 40
Branch analysis from position: 30
1 jumps found. (Code = 42) Position 1 = 29
Branch analysis from position: 29
Branch analysis from position: 40
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 40
filename:       /in/pD8R0
function name:  (null)
number of ops:  42
compiled vars:  !0 = $i, !1 = $s, !2 = $k
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   INIT_FCALL                                               'ini_set'
          1        SEND_VAL                                                 'dsiplay_errors'
          2        SEND_VAL                                                 'On'
          3        DO_ICALL                                                 
    3     4        INIT_FCALL                                               'error_reporting'
          5        SEND_VAL                                                 -1
          6        DO_ICALL                                                 
    6     7        INIT_ARRAY                                       ~5      '1.png', 'save'
    7     8        ADD_ARRAY_ELEMENT                                ~5      '..%2F..%2F1.png', 'dt'
    8     9        INIT_FCALL                                               'urlencode'
         10        SEND_VAL                                                 '..%2F..%2F1.png'
         11        DO_ICALL                                         $6      
         12        ADD_ARRAY_ELEMENT                                ~5      $6, 'dt_url_e'
    9    13        INIT_FCALL                                               'urlencode'
         14        INIT_FCALL                                               'urlencode'
         15        SEND_VAL                                                 '..%2F..%2F1.png'
         16        DO_ICALL                                         $7      
         17        SEND_VAR                                                 $7
         18        DO_ICALL                                         $8      
         19        ADD_ARRAY_ELEMENT                                ~5      $8, 'dt_durl_e'
   10    20        ADD_ARRAY_ELEMENT                                ~5      '..%25c0%25af..%25c0%25af1.png', 'dt_utf8'
   11    21        INIT_FCALL                                               'urldecode'
         22        SEND_VAL                                                 '..%2F..%2F1.png'
         23        DO_ICALL                                         $9      
         24        ADD_ARRAY_ELEMENT                                ~5      $9, 'dt_url_d'
   12    25        ADD_ARRAY_ELEMENT                                ~5      '..%2F..%2F1.png%2500', 'dt_nb_d'
   13    26        ADD_ARRAY_ELEMENT                                ~5      '..%2F..%2F1.png+', 'dt_nb'
    5    27        ASSIGN                                                   !0, ~5
   16    28      > FE_RESET_R                                       $11     !0, ->40
         29    > > FE_FETCH_R                                       ~12     $11, !1, ->40
         30    >   ASSIGN                                                   !2, ~12
   18    31        ECHO                                                     '----------------------------------%0A'
   19    32        CONCAT                                           ~14     '%2A%2A+case%3A+', !2
         33        CONCAT                                           ~15     ~14, '%0A%0A'
         34        ECHO                                                     ~15
   21    35        INIT_FCALL_BY_NAME                                       'fi'
         36        SEND_VAR_EX                                              !1
         37        DO_FCALL                                      0          
   23    38        ECHO                                                     '----------------------------------%0A%0A'
   16    39      > JMP                                                      ->29
         40    >   FE_FREE                                                  $11
   40    41      > RETURN                                                   1

Function fi:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/pD8R0
function name:  fi
number of ops:  43
compiled vars:  !0 = $s, !1 = $s_d, !2 = $p
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   26     0  E >   RECV                                             !0      
   28     1        INIT_FCALL                                               'urldecode'
          2        SEND_VAR                                                 !0
          3        DO_ICALL                                         $3      
          4        ASSIGN                                                   !1, $3
   29     5        INIT_FCALL                                               'pathinfo'
          6        SEND_VAR                                                 !0
          7        DO_ICALL                                         $5      
          8        ASSIGN                                                   !2, $5
   31     9        CONCAT                                           ~7      'input%3A+', !0
         10        CONCAT                                           ~8      ~7, '%0A'
         11        ECHO                                                     ~8
   32    12        CONCAT                                           ~9      'input+urldecoded%3A+', !1
         13        CONCAT                                           ~10     ~9, '%0A'
         14        ECHO                                                     ~10
   33    15        INIT_FCALL                                               'realpath'
         16        SEND_VAR                                                 !0
         17        DO_ICALL                                         $11     
         18        CONCAT                                           ~12     'realpath%3A+', $11
         19        CONCAT                                           ~13     ~12, '%0A'
         20        ECHO                                                     ~13
   34    21        INIT_FCALL                                               'basename'
         22        SEND_VAR                                                 !0
         23        DO_ICALL                                         $14     
         24        CONCAT                                           ~15     'basename%3A+', $14
         25        CONCAT                                           ~16     ~15, '%0A'
         26        ECHO                                                     ~16
   36    27        INIT_FCALL                                               'realpath'
         28        SEND_VAR                                                 !1
         29        DO_ICALL                                         $17     
         30        CONCAT                                           ~18     'realpath+url-d%3A+', $17
         31        CONCAT                                           ~19     ~18, '%0A'
         32        ECHO                                                     ~19
   37    33        INIT_FCALL                                               'basename'
         34        SEND_VAR                                                 !1
         35        DO_ICALL                                         $20     
         36        CONCAT                                           ~21     'basename+url-d%3A+', $20
         37        CONCAT                                           ~22     ~21, '%0A'
         38        ECHO                                                     ~22
   39    39        INIT_FCALL                                               'var_dump'
         40        SEND_VAR                                                 !2
         41        DO_ICALL                                                 
   40    42      > RETURN                                                   null

End of function fi

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
168 ms | 1404 KiB | 29 Q