I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example.
The code below should return the lowercase version of each string in the array.
My question is, Why using 'array_walk_recursive' function seems to fix the code injection in this case?
Legit use of the function
<?
$arr = ['HELLO'];
array_walk_recursive(
$arr,
create_function('&$value, $key', '$value = strtolower($value);')
);
print_r($arr);
?>
Array
(
[0] => hello
)
Trying to Inject command but the PHP code is not evaluated. A string is returned
<?
$arr = ['PHPINFO();'];
array_walk_recursive(
$arr,
create_function('&$value, $key', '$value = strtolower($value);')
);
print_r($arr);
?>
Array (
[0] => phpinfo();
)
Trying to put the phpinfo() inside create_function
(Note that phpinfo ran. The warning is from a php sandbox)
<?
$arr = ['anything'];
array_walk_recursive(
$arr,
create_function(
'&$value, $key',
'phpinfo(); $value = strtolower($value);'
)
);
print_r($arr);
?>
*<b>Warning</b>: phpinfo() has been disabled for security reasons in <b>[...][...](32) : runtime-created function</b> on line <b>1</b><br />
Array
(
[0] => anything
)*