2

After wondering about this and trying to better understanding, I tried the folowing code:

    is_string(3 and sleep(30));

Why PHP will execute code inside a parameter function (sleep in is_string) ?

And what is the role of logical operators in this case ?

Int as first in parameter for is_string:
is_string(3 and sleep(30));      // Exeuction of sleep()
is_string(3 or sleep(30));       // No-execution of sleep()
is_string(3 xor sleep(30))       // Execution of sleep()

String as first in parameter for is_string:
is_string("abc" and sleep(30));  // Execution of sleep()
is_string("abc" or sleep(30));  // No-execution of sleep()
is_string("abc" xor sleep(30));  // Execution of sleep()

Thanks,

closed as off-topic by symcbean, Steffen Ullrich, Conor Mancone, Tobi Nary, Xander Jan 31 at 21:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Conor Mancone, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why not? A function parameter could be any expression or operator. Does it make you wonder when we do fopen($dir.'/file')? This question doesn't belong to security@SO but rather to Stack Overflow and most likely has been answered there many times already. As to why or made "no-execution", I wrote a nice article, that explains it in detail phpdelusions.net/articles/or_die – Your Common Sense Jan 28 at 16:09
  • Possible duplicate of PHP assert code injection – symcbean Jan 28 at 16:51
  • This is already answered in the question you linked: "usage of simple quotes, $entityId won't be interpolated" - in the absence of the single quotes the value inside the brackets will be evaluated. – symcbean Jan 28 at 16:53
0

Why PHP will execute code inside a parameter function (sleep in is_string) ?

When a function is called each parameter can be an expression. This is true for almost all languages and might be more obvious when you use something like is_string("foo" . "bar").

And what is the role of logical operators in this case ?

and just evaluates and combines the parts from left to right to get a result. 3 and sleep(30) just means that it will treat 3 as a boolean and if this boolean is True (which it is in case if 3) it will evaluate the right side of the and operator and thus execute sleep(30).

Not the answer you're looking for? Browse other questions tagged or ask your own question.