Php动态函数注入漏洞

1&varname=myvar">?varname=myvar</a>
<tr>
<td>Dynamic function evaluation
<td><a href="?test=2&myfunc=phpinfo">?myfunc=phpinfo</a>
<tr>
<td>Eval injection
<td><a href="?test=3&ev=do_this();">?ev=do_this();</a>
</table>
<p>

<?php
// error_reporting(8);
// ini_set('display_errors', 1);
// ini_set('display_startup_errors', 1);

function do_this () { echo "Do this!<br>"; }

$test = $_GET['test'];
if ($test == 1)
{
echo "<b>=== Implicit variable evaluation in \$myvar ===</b><br>\n";
echo "Parameter varname = " . $_GET['varname'] . "<br>\n";
$myvar = "unchangeable value";
echo "before: \$myvar = \"" . $myvar . "\"<br>\n";
$varname = $_GET['varname'];
echo "EXECUTE: \$\$varname = \"new value\";<br>\n";
$$varname = "new value";
echo "after: \$myvar = \"" . $myvar . "\"<br>\n";
}
elseif ($test == 2)
{
echo "<b>=== Implicit function evaluation in \$myfunc ===</b><br>\n";
$myfunc = $_GET['myfunc'];
echo "EXECUTE: \$myfunc();<br>\n";
${"myfunc"}();
$myfunc();
}
elseif ($test == 3)
{
echo "<b>=== Eval Injection in \$ev ===</b><br>\n";
$ev = $_GET['ev'];
echo "EXECUTE: eval(\$ev);<br>\n";
echo "actual statement will be: eval($ev)<br><br><br>\n";
eval($ev);
}
?>