why would simply executing it be a security vulnerability?
It's not.
base64_decode
does exactly what you would expect: It decodes a string.
There are also no know vulnerabilities in it, nor have there been in the past (there was an integer overflow issue in base64_encode
- CVE-2003-0861 - but PHP does not consider it a security issue).
I would assume that http://phptester.net/ bans it because it can be used to obfuscate data. They may have some filters in place to prevent execution of dangerous code and may worry that base64_decode
could be used to bypassed these filters. I don't think that this is necessary or useful, but that might be their train of thought.
if(strstr($code, "eval") !== false || strstr($code, "readfile") !== false || ...) {echo "Security fail!"; exit;}