Safe: PHP 代码审计-PHP语言

{
  "php.validate.executablePath": "/usr/bin/php",
  "phpserver.phpConfigPath": "/etc/php.ini",
}

#windows
{
  "php.validate.executablePath": "D:/xampp/php/php.exe",
  "phpserver.phpConfigPath": "D:/xampp/php/php.ini"
  "phpserver.phpPath": "D:/xampp/php/php.exe"
}

#mac
{
  "phpserver.phpConfigPath": "/opt/homebrew/etc/php/8.1/php.ini",
  "php.validate.executablePath": "/opt/homebrew/Cellar/[email protected]/8.1.22/bin/php"
}

你好，<?php echo htmlspecialchars($_POST['name']); ?>。
你 <?php echo (int)$_POST['age']; ?> 岁了。

<?php
echo 'this is a simple string', PHP_EOL;

// 可以录入多行
echo 'You can also have embedded newlines in
strings this way as it is
okay to do', PHP_EOL;

// 输出： Arnold once said: "I'll be back"
echo 'Arnold once said: "I\'ll be back"', PHP_EOL;

// 输出： You deleted C:\*.*?
echo 'You deleted C:\\*.*?', PHP_EOL;

// 输出： You deleted C:\*.*?
echo 'You deleted C:\*.*?', PHP_EOL;

// 输出： This will not expand: \n a newline
echo 'This will not expand: \n a newline', PHP_EOL;

// 输出： Variables do not $expand $either
echo 'Variables do not $expand $either', PHP_EOL;
?>

<?php
// 无缩进
echo <<<END
      a
     b
    c
\n
END;
// 4 空格缩进
echo <<<END
      a
     b
    c
    END;

#Output of the above example in PHP 8.4.4:
      a
     b
    c
  a
 b
c

<?php
echo <<<END
  a
 b
c
   END;

#Output of the above example in PHP 8.4.4:
Parse error: Invalid body indentation level (expecting an indentation level of at least 3) in script on line 3

<?php
// 以下所有代码都不起作用。
// 正文（空格）和结束标记（制表符），不同的缩进
{
    echo <<<END
     a
        END;
}
// 在正文中混合空格和制表符
{
    echo <<<END
        a
     END;
}
// 在结束标记中混合空格和制表符
{
    echo <<<END
          a
         END;
}

#以上示例在 PHP 7.3 中的输出：
Parse error: Invalid indentation - tabs and spaces cannot be mixed in example.php line 8

<?php
$values = [<<<END
a
  b
    c
END, 'd e f'];
var_dump($values);

#以上示例在 PHP 7.3 中的输出：
array(2) {
  [0] =>
  string(11) "a
  b
    c"
  [1] =>
  string(5) "d e f"
}

<?php
$str = <<<EOD
Example of string
spanning multiple lines
using heredoc syntax.
EOD;

/* 含有变量的更复杂示例 */
class foo
{
    var $foo;
    var $bar;

    function __construct()
    {
        $this->foo = 'Foo';
        $this->bar = array('Bar1', 'Bar2', 'Bar3');
    }
}

$foo = new foo();
$name = 'MyName';

echo <<<EOT
My name is "$name". I am printing some $foo->foo.
Now, I am printing some {$foo->bar[1]}.
This should print a capital 'A': \x41
EOT;
?>

My name is "MyName". I am printing some Foo.
Now, I am printing some Bar2.
This should print a capital 'A': A

<?php
var_dump(array(<<<EOD
foobar!
EOD
));
?>

#Output of the above example in PHP 8.4.4:
array(1) {
  [0]=>
  string(7) "foobar!"
}

<?php
// 静态变量
function foo()
{
    static $bar = <<<LABEL
Nothing in here...
LABEL;
}

// 类的常量、属性
class foo
{
    const BAR = <<<FOOBAR
Constant example
FOOBAR;

    public $baz = <<<FOOBAR
Property example
FOOBAR;
}
?>

<?php
echo <<<"FOOBAR"
Hello World!
FOOBAR;
?>

#Output of the above example in PHP 8.4.4:
Hello World!

<?php
echo <<<'EOD'
Example of string spanning multiple lines
using nowdoc syntax. Backslashes are always treated literally,
e.g. \\ and \'.
EOD;

Example of string spanning multiple lines
using nowdoc syntax. Backslashes are always treated literally,
e.g. \\ and \'.

<?php

/* 含有变量的更复杂的示例 */
class foo
{
    public $foo;
    public $bar;

    function __construct()
    {
        $this->foo = 'Foo';
        $this->bar = array('Bar1', 'Bar2', 'Bar3');
    }
}

$foo = new foo();
$name = 'MyName';

echo <<<'EOT'
My name is "$name". I am printing some $foo->foo.
Now, I am printing some {$foo->bar[1]}.
This should not print a capital 'A': \x41
EOT;
?>

My name is "$name". I am printing some $foo->foo.
Now, I am printing some {$foo->bar[1]}.
This should not print a capital 'A': \x41

<?php
class foo {
    public $bar = <<<'EOT'
bar
EOT;
}
?>

<?php
$juice = "apple";

echo "He drank some $juice juice." . PHP_EOL;

?>

He drank some apple juice.

string-variable::
     variable-name   (offset-or-property)?
   | ${   expression   }

offset-or-property::
     offset-in-string
   | property-in-string

offset-in-string::
     [   name   ]
   | [   variable-name   ]
   | [   integer-literal   ]

property-in-string::
     ->  name

variable-name::
     $   name

name::
     [a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*

<?php
$juices = array("apple", "orange", "string_key" => "purple");

echo "He drank some $juices[0] juice.";
echo PHP_EOL;
echo "He drank some $juices[1] juice.";
echo PHP_EOL;
echo "He drank some $juices[string_key] juice.";
echo PHP_EOL;

class A {
    public $s = "string";
}

$o = new A();

echo "Object value: $o->s.";
?>

He drank some apple juice.
He drank some orange juice.
He drank some purple juice.
Object value: string.

<?php
$string = 'string';
echo "The character at index -2 is $string[-2].", PHP_EOL;
$string[-3] = 'o';
echo "Changing the character at index -3 to o gives $string.", PHP_EOL;
?>

The character at index -2 is n.
Changing the character at index -3 to o gives strong.

<?php
const DATA_KEY = 'const-key';
$great = 'fantastic';
$arr = [
    '1',
    '2',
    '3',
    [41, 42, 43],
    'key' => 'Indexed value',
    'const-key' => 'Key with minus sign',
    'foo' => ['foo1', 'foo2', 'foo3']
];

// 无效，输出 This is { fantastic}
echo "This is { $great}";

// 有效，输出 This is fantastic
echo "This is {$great}";

class Square {
    public $width;

    public function __construct(int $width) { $this->width = $width; }
}

$square = new Square(5);

// 有效
echo "This square is {$square->width}00 centimeters wide.";


// 有效，引用 key 仅使用花括号语法时有效
echo "This works: {$arr['key']}";


// 有效
echo "This works: {$arr[3][2]}";

echo "This works: {$arr[DATA_KEY]}";

// 使用多维数组时，在字符串内部时，始终使用括号括住数组
echo "This works: {$arr['foo'][2]}";

echo "This works: {$obj->values[3]->name}";

echo "This works: {$obj->$staticProp}";

// 无效，输出 C:\directory\{fantastic}.txt
echo "C:\directory\{$great}.txt";

// 有效，输出 C:\directory\fantastic.txt
echo "C:\\directory\\{$great}.txt";
?>

#Output of the above example in PHP 8.4.4:
This is { fantastic}This is fantasticThis square is 500 centimeters wide.This works: Indexed valueThis works: 43This works: Key with minus signThis works: foo3
Warning: Undefined variable $obj in script on line 44
Warning: Attempt to read property "values" on null in script on line 44
Warning: Trying to access array offset on null in script on line 44
Warning: Attempt to read property "name" on null in script on line 44
This works: 
Warning: Undefined variable $obj in script on line 46
Warning: Undefined variable $staticProp in script on line 46
Warning: Attempt to read property "" on null in script on line 46
This works: C:\directory\{fantastic}.txtC:\directory\fantastic.txt

<?php
// 取得字符串的第一个字符
$str = 'This is a test.';
$first = $str[0];
var_dump($first);

// 取得字符串的第三个字符
$third = $str[2];
var_dump($third);

// 取得字符串的最后一个字符
$str = 'This is still a test.';
$last = $str[strlen($str)-1];
var_dump($last);

// 修改字符串的最后一个字符
$str = 'Look at the sea';
$str[strlen($str)-1] = 'e';
var_dump($str);
?>

#Output of the above example in PHP 8.4.4:
string(1) "T"
string(1) "i"
string(1) "."
string(15) "Look at the see"

<?php
$str = 'abc';

$keys = [ '1', '1.0', 'x', '1x' ];

foreach ($keys as $keyToTry) {
    var_dump(isset($str[$keyToTry]));

    try {
        var_dump($str[$keyToTry]);
    } catch (TypeError $e) {
        echo $e->getMessage(), PHP_EOL;
    }

    echo PHP_EOL;
}
?>

bool(true)
string(1) "b"

bool(false)
Cannot access offset of type string on string

bool(false)
Cannot access offset of type string on string

bool(false)

Warning: Illegal string offset "1x" in Standard input code on line 10
string(1) "b"

array(
    key  => value,
    key2 => value2,
    key3 => value3,
    ...
)

注意: 可以用短数组语法 [] 替代 array() 。

<?php
$array1 = array(
    "foo" => "bar",
    "bar" => "foo",
);

// 使用短数组语法
$array2 = [
    "foo" => "bar",
    "bar" => "foo",
];

var_dump($array1, $array2);
?>

#Output of the above example in PHP 8.4.4:
array(2) {
  ["foo"]=>
  string(3) "bar"
  ["bar"]=>
  string(3) "foo"
}
array(2) {
  ["foo"]=>
  string(3) "bar"
  ["bar"]=>
  string(3) "foo"
}

<?php
$array = array(
    1    => "a",
    "1"  => "b",
    1.5  => "c",
    true => "d",
);
var_dump($array);
?>

array(1) {
  [1]=>
  string(1) "d"
}

<?php
$array = array(
    "foo" => "bar",
    "bar" => "foo",
    100   => -100,
    -100  => 100,
);
var_dump($array);
?>

array(4) {
  ["foo"]=>
  string(3) "bar"
  ["bar"]=>
  string(3) "foo"
  [100]=>
  int(-100)
  [-100]=>
  int(100)
}

<?php
$array = array("foo", "bar", "hello", "world");
var_dump($array);
?>

array(4) {
  [0]=>
  string(3) "foo"
  [1]=>
  string(3) "bar"
  [2]=>
  string(5) "hello"
  [3]=>
  string(5) "world"
}

<?php
$array = array(
         "a",
         "b",
    6 => "c",
         "d",
);
var_dump($array);
?>

array(4) {
  [0]=>
  string(1) "a"
  [1]=>
  string(1) "b"
  [6]=>
  string(1) "c"
  [7]=>
  string(1) "d"
}

<?php
$array = array(
    1    => 'a',
    '1'  => 'b', // 值 "a" 会被 "b" 覆盖
    1.5  => 'c', // 值 "b" 会被 "c" 覆盖
    -1 => 'd',
    '01'  => 'e', // 由于这不是整数字符串，因此不会覆盖键名 1
    '1.5' => 'f', // 由于这不是整数字符串，因此不会覆盖键名 1
    true => 'g', // 值 "c" 会被 "g" 覆盖
    false => 'h',
    '' => 'i',
    null => 'j', // 值 "i" 会被 "j" 覆盖
    'k', // 值 “k” 的键名被分配为 2。这是因为之前最大的整数键是 1
    2 => 'l', // 值 "k" 会被 "l" 覆盖
);

var_dump($array);
?>

array(7) {
  [1]=>
  string(1) "g"
  [-1]=>
  string(1) "d"
  ["01"]=>
  string(1) "e"
  ["1.5"]=>
  string(1) "f"
  [0]=>
  string(1) "h"
  [""]=>
  string(1) "j"
  [2]=>
  string(1) "l"
}

<?php
$array = [];

$array[-5] = 1;
$array[] = 2;

var_dump($array);
?>

array(2) {
  [-5]=>
  int(1)
  [-4]=>
  int(2)
}

<?php
$array = array(
    "foo" => "bar",
    42    => 24,
    "multi" => array(
         "dimensional" => array(
             "array" => "foo"
         )
    )
);

var_dump($array["foo"]);
var_dump($array[42]);
var_dump($array["multi"]["dimensional"]["array"]);
?>

string(3) "bar"
int(24)
string(3) "foo"

<?php
function getArray() {
    return array(1, 2, 3);
}

$secondElement = getArray()[1];

var_dump($secondElement);
?>

#Output of the above example in PHP 8.4.4:
int(2)

// 或
<?php

function getArray() {
    return array(1,2,3);
}

//$sendElement = getArray()[1];

list(, $sendElement) = getArray();
echo $sendElement;

$arr[key] = value;
$arr[] = value;
// key 可以是 int 或 string
// value 可以是任意类型的值

<?php
$arr = array(5 => 1, 12 => 2);

$arr[] = 56;    // 这与 $arr[13] = 56 相同;
                // 在脚本的这一点上

$arr["x"] = 42; // 添加一个新元素
                // 键名使用 "x"

unset($arr[5]); // 从数组中删除元素

unset($arr);    // 删除整个数组
?>

<?php
// 创建一个简单的数组
$array = array(1, 2, 3, 4, 5);
print_r($array);

// 现在删除其中的所有元素，但保持数组本身不变:
foreach ($array as $i => $value) {
    unset($array[$i]);
}
print_r($array);

// 添加一个单元（注意新的键名是 5，而不是你可能以为的 0）
$array[] = 6;
print_r($array);

// 重新索引：
$array = array_values($array);
$array[] = 7;
print_r($array);
?>

Array
(
    [0] => 1
    [1] => 2
    [2] => 3
    [3] => 4
    [4] => 5
)
Array
(
)
Array
(
    [5] => 6
)
Array
(
    [0] => 6
    [1] => 7
)

<?php
$source_array = ['foo', 'bar', 'baz'];

[$foo, $bar, $baz] = $source_array;

echo $foo, PHP_EOL;    // 打印 "foo"
echo $bar, PHP_EOL;    // 打印 "bar"
echo $baz, PHP_EOL;    // 打印 "baz"
?>

#Output of the above example in PHP 8.4.4:
foo
bar
baz

<?php
$source_array = [
    [1, 'John'],
    [2, 'Jane'],
];

foreach ($source_array as [$id, $name]) {
    echo "{$id}: '{$name}'\n";
}
?>

#Output of the above example in PHP 8.4.4:
1: 'John'
2: 'Jane'

<?php
$source_array = ['foo', 'bar', 'baz'];

// 将索引 2 的元素分配给变量 $baz
[, , $baz] = $source_array;

echo $baz;    // 打印 "baz"
?>

#Output of the above example in PHP 8.4.4:
baz

<?php
$source_array = ['foo' => 1, 'bar' => 2, 'baz' => 3];

// 将索引 'baz' 处的元素分配给变量 $three
['baz' => $three] = $source_array;

echo $three, PHP_EOL;    // 打印 3

$source_array = ['foo', 'bar', 'baz'];

// 将索引 2 处的元素分配给变量 $baz
[2 => $baz] = $source_array;

echo $baz, PHP_EOL;    // 打印 "baz"
?>

#Output of the above example in PHP 8.4.4:
3
baz

<?php
$a = 1;
$b = 2;

[$b, $a] = [$a, $b];

echo $a, PHP_EOL;    // 打印 2
echo $b, PHP_EOL;    // 打印 1
?>

<?php
$foo[bar] = 'enemy';
echo $foo[bar];
// 及其它
?>

<?php
error_reporting(E_ALL);
ini_set('display_errors', true);
ini_set('html_errors', false);

// 简单数组:
$array = array(1, 2);
$count = count($array);

for ($i = 0; $i < $count; $i++) {
    echo "\n检查 $i: \n";
    echo "坏的: " . $array['$i'] . "\n";
    echo "好的: " . $array[$i] . "\n";
    echo "坏的: {$array['$i']}\n";
    echo "好的: {$array[$i]}\n";
}
?>

检查 0:
Notice: Undefined index:  $i in /path/to/script.html on line 9
坏的:
好的: 1
Notice: Undefined index:  $i in /path/to/script.html on line 11
坏的:
好的: 1

检查 1:
Notice: Undefined index:  $i in /path/to/script.html on line 9
坏的:
好的: 2
Notice: Undefined index:  $i in /path/to/script.html on line 11
坏的:
好的: 2

<?php
// 显示所有错误
error_reporting(E_ALL);

$arr = array('fruit' => 'apple', 'veggie' => 'carrot');

// Correct
echo $arr['fruit'], PHP_EOL;  // apple
echo $arr['veggie'], PHP_EOL; // carrot

// Incorrect. This works but also throws a PHP Error because
// of an undefined constant named fruit
//
// Error: Undefined constant "fruit"
try {
    echo $arr[fruit];    // apple
} catch (Error $e) {
    echo get_class($e), ': ', $e->getMessage(), PHP_EOL;
}

// This defines a constant to demonstrate what's going on.  The value 'veggie'
// is assigned to a constant named fruit.
define('fruit', 'veggie');

// Notice the difference now
echo $arr['fruit'], PHP_EOL;  // apple
echo $arr[fruit], PHP_EOL;    // carrot

// The following is okay, as it's inside a string. Constants are not looked for
// within strings, so no E_NOTICE occurs here
echo "Hello $arr[fruit]", PHP_EOL;      // Hello apple

// With one exception: braces surrounding arrays within strings allows constants
// to be interpreted
echo "Hello {$arr[fruit]}", PHP_EOL;    // Hello carrot
echo "Hello {$arr['fruit']}", PHP_EOL;  // Hello apple

// Concatenation is another option
echo "Hello " . $arr['fruit'], PHP_EOL; // Hello apple
?>

#Output of the above example in PHP 8.4.4:
apple
carrot
Error: Undefined constant "fruit"
apple
carrot
Hello apple
Hello carrot
Hello apple
Hello apple

// 这将不起作用，并会导致解析错误，例如：
// Parse error: parse error, expecting T_STRING' or T_VARIABLE' or T_NUM_STRING'
// 这当然也适用于在字符串中使用超全局变量
print "Hello $arr['fruit']";
print "Hello $_GET['foo']";
?>

<?php
echo $arr[somefunc($bar)];
?>

<?php
$error_descriptions[E_ERROR]   = "A fatal error has occurred";
$error_descriptions[E_WARNING] = "PHP issued a warning";
$error_descriptions[E_NOTICE]  = "This is just an informal notice";
?>

<?php
$error_descriptions[1] = "A fatal error has occurred";
$error_descriptions[2] = "PHP issued a warning";
$error_descriptions[8] = "This is just an informal notice";
?>