A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments.

Let's say I POST the following:

<?php echo "xy"; /* arbitrary php code */

and I want to get it running. Is there any way to inject something between the < and ? characters that gets skipped during php parsing?


No. PHP will parse the php file looking for either <?php, <? or <?= (depending on the value of short_tags)

However, outputting <?php to the screen would not execute code. It would need to have been evaluated (eg. saved to a .php file in the server that you then run). This form is probably vulnerable to XSS, though.

  • Yes, I injected other DOM elements and javascript to this page, sad to hear I can't go further. Thanks. – Rápli András May 5 '16 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.