PHP GET variable array injection

Question

I've recently learned that it's possible to inject arrays into PHP GET variables to perform code execution?

.php?a[]=asd&a[]=asdasd&b[]=$a

That was the example I was given. I have no idea how it works and was wondering if this is even possible?

Answer 1

It seems like you misunderstood something.

The above example simply creates an array like

Array (
  [a] => Array (
    [0] => asd
    [1] => asdasd
  )
  [b] => Array ( [0] => $a )
)

This is documented and works exactly as intended.

Answer 2

echo $_GET['a'][0]; //prints "asd"
echo $_GET['a'][1]; //prints "asdasd"
echo $_GET['b'][0]; //prints "$a"

Answer 3

I think he is talking about something evaluating differently when passed an array

strcasecmp( $_GET['password'], $password ) == 0 ) { echo($secret); } ` If you pass an empty array into strcasecmp it will evaluate to true for whatever reason.

IE: index.php?password=[]