3 ms·
The actual quote from the manual, that they appear to be referencing, is: Internally, PHP strings are byte arrays. As a result, accessing or modifying a string
by randomdrake 13y ago
The actual quote from the manual, that they appear to be referencing, is:
Internally, PHP strings are byte arrays. As a result, accessing or modifying a string using array brackets is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
It seems like they just replaced:
is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
...with...
will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met.
- tshadwell 13y agoBut multi-byte safety is one thing, and executing arbitrary code is another. It's still not an explanation of how you go from injecting a deformed string to executing code.