1

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments.

Let's say I POST the following:

<?php echo "xy"; /* arbitrary php code */

and I want to get it running. Is there any way to inject something between the < and ? characters that gets skipped during php parsing?

Improve this question

1 Answer 1

Reset to default
6

No. PHP will parse the php file looking for either <?php, <? or <?= (depending on the value of short_tags)

However, outputting <?php to the screen would not execute code. It would need to have been evaluated (eg. saved to a .php file in the server that you then run). This form is probably vulnerable to XSS, though.

Improve this answer
1
  • Yes, I injected other DOM elements and javascript to this page, sad to hear I can't go further. Thanks.
    – Rápli András
    May 5, 2016 at 0:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .