I've recently learned that it's possible to inject arrays into PHP GET variables to perform code execution?
.php?a[]=asd&a[]=asdasd&b[]=$a
That was the example I was given. I have no idea how it works and was wondering if this is even possible?
PHP will parse the query string, and inject those values in the $_GET
super-global array (same for $_POST
if this was done in a form using POST, btw).
In your case, the $_GET
array will contain this :
array
'a' =>
array
0 => string 'asd' (length=3)
1 => string 'asdasd' (length=6)
'b' =>
array
0 => string '$a' (length=2)
Each value passed in the query string will be put by PHP in the $_GET
array, creating sub-arrays if necessary, when there are []
used in the query string.
But this doesn't cause any kind of "code execution" : as long as you deal with input properly (i.e. don't trust the input and use eval
on it, or any kind of bad idea like this), there is no risk of code-injection.