Is it possible to perform null byte injection on PHP code? And, how would vulnerable code look like? Could you give me some examples, as I noticed that:


echo $_GET['get'];

Will not make code vulnerable. I want to know, what are possible security flaws in code that can cause this kind of vulnerability, if possible. Any example would be appreciated and useful.


2 Answers 2


Null byte injection in PHP concerns how null bytes are handled in filesystem operations. If an attacker can inject a null byte into a filepath, the underlying C function will disregard anything after the malicious character. This can be used in order to bypass constraints such as the intended file's extension.

The following example is from php.net:

$file = $_GET['file']; // "../../etc/passwd\0"
if (file_exists('/home/wwwrun/'.$file.'.php')) {
    // file_exists will return true as the file /home/wwwrun/../../etc/passwd exists
    include '/home/wwwrun/'.$file.'.php';
    // the file /etc/passwd will be included


In this case, the '.php' extension will be ignored during file operations if the user submits a null character at the end of the file parameter. Combined with a directory traversal string, it allows the attacker to "include" arbitrary files that will be disclosed.


This information is only relevant for older (unsupported) versions of PHP.

Null byte injection has been fixed in PHP 5.3.4 (which it's self is already an old and unsupported PHP version): https://bugs.php.net/bug.php?id=39863.

  • 3
    It was fixed for a limited subset of functions. The vulnerability in (include/require)(_once) persisted. On some instances, when magic_quotes_gpc is enabled, the null-byte is escaped and that induce the idea of it being fixed.
    – FanaticD
    Commented Feb 26, 2018 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .