I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:

if( $_POST["var"] != "" ) {
    print "Current value: ".$_POST["var"]."\n";

But if I try to inject PHP code ("; print phpinfo();, " etc.) I just get it echoed back to me instead of executing it.

I'm aware of how to clean the input using htmlspecialchars, addcslashes, mysqli_real_escape_string etc. but before I use them - what syntax do I need to successfully inject arbitrary PHP code?

I have noticed that my machine has the PHP Suhosin patch installed (Ubuntu 10.10) - would that be auto-escaping/sanitising my input for me?

3 Answers 3


For that code, I wouldnt expect to get PHP injection, but I'd look at Cross-Site Scripting (XSS) instead.

For example, try injecting:

<script> alert('woot Security.SE rulez!');</script>
  • 1
    Confirmed, and fixed with htmlspecialchars. After consulting with our guru I'll rework it to a static page so I won't have to worry about it anyway.
    – Andrew
    Feb 17, 2011 at 1:51
  • learn much from here. Mar 5, 2015 at 3:47

"PHP Injection" isn't possible unless your application is using include(), require(), eval(), create_function(), or any of those similar functions that invoke the interpreter. Or if your application writes out to files in PHP's path that end with .php, .phtml, or any other PHP registered file extensions.

As pointed out by AviD, though, markup and script injection are definitely possible in your example.

Try downloading "Tamper Data"... it's an Add-on for Firefox that it makes laughably easy to perform injection attacks against a web application. It even has some built-in default attacks that you can try, in case you're not aware of any yourself!


Just FYI I wouldn't consider using stripcslashes as it could also cause XSS.

Let me explain: stripslashes vs stripcslashes

stripslashes removes all backslashes regardless of type

stripcslashes will remove all backslashes except hex characters, so what this means is that you could perform an XSS attack on a function that uses stripcslashes by doing something like this:


Which when evaluated by the stripcslashes function will result in : alert('XSS!');

This was actually a vulnerability I found within a popular Wordpress plugin (Platinum SEO <= 1.3.7)

Just make sure you do your research on the functions you are using before you use them as you could be causing more issues than it's worth.

This also applies to your usage of addcslashes() as you could force it to evaluate code where you don't want it to, like so:

$>php -r 'echo addcslashes("\x41", "A..z");' 

And here is a basic example of that in use for a malformed XSS string:

> php -r 'echo addcslashes("\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x27\x58\x53\x53\x21\x27\x29\x3b\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e", "/");'   

As you can see, that would still execute the alert.

As mehaase confirmed, there is no possible way of invoking PHP code without using something like include(), require(), eval(), system() (You've got more worries if you are using system() on user input than PHP Arbitrary code execution).

  • Oh wow, just realized this is a really old question, I don't know why it appeared at the top of my feed -.- Sigh.
    – DarkMantis
    Sep 25, 2013 at 11:24
  • no matter, it's useful info.
    – Andrew
    Sep 26, 2013 at 3:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .