An error occurs when php eval calls the variable.

It is determined that the PHP code on the server (which cannot be modified) is {code...}, but an error occurs when a call is made. Because of project requirements. The base64_decode (& quot; base64 processed string & quot;) must be used for value transfer. Therefore, the url used for testing is as follows: test. cn2.php? Command... now you have determined that the server PHP code (cannot be modified) is

However, an error occurs during a call.
Because of project requirements. Base64_decode ("base64 processed string") must be used when transferring values ");
The url used during my test is as follows:
Http://test.cn/2.php? Command = base64_decode ("ZWNobyAndGVzdCc7 ");
However, the returned page does not contain any content.
If base64_decode function is not used, nothing happens, as shown below:
Http://test.cn/2.php? Command = echo "123 ";
Display 123.

The string before ZWNobyAndGVzdCc7 encoding is echo 'test ';

The server code cannot be modified. The request must be base64_decode ("base64 encoded string. It's been a day of trouble.

Reply content:

It is determined that the server PHP code (cannot be modified) is

However, an error occurs during a call.
Because of project requirements. Base64_decode ("base64 processed string") must be used when transferring values ");
The url used during my test is as follows:
Http://test.cn/2.php? Command = base64_decode ("ZWNobyAndGVzdCc7 ");
However, the returned page does not contain any content.
If base64_decode function is not used, nothing happens, as shown below:
Http://test.cn/2.php? Command = echo "123 ";
Display 123.

The string before ZWNobyAndGVzdCc7 encoding is echo 'test ';

The server code cannot be modified. The request must be base64_decode ("base64 encoded string. It's been a day of trouble.

Warning: Using eval is a very dangerous behavior!
In particular, if you do not even have any encryption or filtering processing for this command parameter, you can pass a parameter one day to view, display, edit, or even modify it, code for deleting all files on the server can also be run directly (when your PHP is running as root)

Leave this aside to analyze this issue.
When the server performs eval, it is actually equivalent to running:

base64_decode("ZWNobyAndGVzdCc7");

In this case, a string is obtained.

echo 'test';

However, because you only have one eval, the base64 decoded text is actually just a piece of text, and the expression ends at this time and will not continue running, therefore, to achieve the goal of the landlord, it should be like this:
http://test.cn/2.php?command=echo base64_decode("dGVzdAo=");
Or:
http://test.cn/2.php?command=eval(base64_decode("ZWNobyAndGVzdCc7"));