Alson Kaw
Security

Display PHP Logo on any URL

An obscure PHP query-string feature could once expose the PHP logo on almost any enabled server, one of the language’s stranger pieces of historical cruft.

Posted on3 Jun 2011
Reading Time1 min
An obscure PHP query-string feature could once expose the PHP logo on almost any enabled server, one of the language’s stranger pieces of historical cruft.
Display PHP Logo on any URL Blogpost Cover

PHP is full of cruft.

For example, PHP has a “feature” wherein if you add '?=PHPE9568F34-D428-11d2-A769-00AA001ACF42' to the end of a script, it produces the PHP logo.

http://en.wikipedia.org/w/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42

You can get this ID with php php_logo_guid.

There is also php zend_logo_guid and an undocumented php_egg_logo_guid() function:

http://digg.com/index.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42

http://php.net/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42

You can also get the PHP developer credits with php phpcredits or ask any PHP script using another code URL:

http://xdebug.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

All of this data is loaded into memory every time a PHP script runs. This takes approximately 21kb of memory (after all the images, credits, and HTML therein) per PHP process, even though these are never used for production applications. Disabling this requires a custom source modification (as of 20100712).