Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I look for answer, is it possible to perform null byte injection on PHP code, and how vulnerable code should look like. Give me some example, as I noticed that:


echo $_GET['get'];

will not make code vulnerable. I want to know, what is possible hole in code, that can cause this kind of vulnerability, if possible. Any example would be appreciated and usefull. Thanks.

share|improve this question
hey thanks for your example. but i am still confused, as in used example on that page, i was able to load file /root/Desktop/demo-password.fl but when i putt %00 on the end of url i get error. what is point of using null byte if i was able to access files without it, and got error with using it. sorry i am just to confused, any idea? – black_hat_cat Jan 6 '14 at 23:49

Null byte injection in PHP concerns how null bytes are handled in filesystem operations. If an attacker can inject a null byte into a filepath, the underlying C function will disregard anything after the malicious character. This can be used in order to bypass constraints such as the intended file's extension.

The following example is from

$file = $_GET['file']; // "../../etc/passwd\0"
if (file_exists('/home/wwwrun/'.$file.'.php')) {
    // file_exists will return true as the file /home/wwwrun/../../etc/passwd exists
    include '/home/wwwrun/'.$file.'.php';
    // the file /etc/passwd will be included

In this case, the '.php' extension will be ignored during file operations if the user submits a null character at the end of the file parameter. Combined with a directory traversal string, it allows the attacker to "include" arbitrary files that will be disclosed.

share|improve this answer

This information is only relevant for older (unsupported) versions of PHP.

Null byte injection has been fixed in PHP 5.3.4 (which it's self is already an old and unsupported PHP version):

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.