Question

I was looking at this question ( Is this a CakePHP hacking of some kind? ), and when I was looking at the code, I saw this line:

$wp_cw_kses_split = '>=^/E]u*PDAF$!V'^']O;N18*L%*"2MN8';

When I echo this, it echos create_function.

How does that work? I mean how is that even a string? There are unescaped ' inside it.

Demo: http://ideone.com/rk2Og

Answer 1

It’s doing a bitwise XOR operation on two strings, '>=^/E]u*PDAF$!V' and ']O;N18*L%*"2MN8'.

var_dump('>' ^ ']'); // string(1) "c"
var_dump('=' ^ 'O'); // string(1) "r"
var_dump('^' ^ ';'); // string(1) "e"
// ... etc

The bitwise XOR operation is done on the ASCII code of the characters, so for the first one,

">" = 62 (ASCII) = 0111110
 ^  = XOR          -------
"]" = 93 (ASCII) = 1011101
==========================
"c" = 99 (ASCII) = 1100011