search
HomeBackend DevelopmentPHP ProblemHow to use runkit extension in PHP

This article will introduce to you how to use the runkit extension in PHP. It has certain reference value. Friends in need can refer to it. I hope it will be helpful to everyone.

How to use runkit extension in PHP

#This time we bring you a fun expansion. We know that when PHP is running, that is, after deployment is completed, we cannot modify the values ​​of constants, nor can we modify the implementation inside the method body. In other words, after we complete the coding, we upload the code to the server. At this time, we cannot modify the value of a constant without modifying the code. The constant itself cannot be modified. However, the runkit extension can help us accomplish this function.

Dynamic modification of constants

define('A', 'TestA');

runkit_constant_redefine('A', 'NewTestA');

echo A; // NewTestA

Isn’t it amazing? This runkit extension is a functional extension that allows us to dynamically modify some constants, method bodies, and classes at runtime. Of course, from a system security perspective, this extension is not highly recommended. Because the meaning of a constant is an unchanging quantity, it should not be modified. In the same way, dynamically changing the content of a function body or class definition at runtime may affect other code that calls these functions or classes. Therefore, this extension is a dangerous extension.

In addition to dynamically modifying constants, we can also use the runkit_constant_add() and runkit_constant_remove() functions to dynamically add or delete constants.

Installation

To install the runkit extension, you need to download it from github and then compile the extension normally. The one downloaded from pecl is outdated.

PHP5: http://github.com/zenovich/runkit

PHP7: https://github.com/runkit7/runkit7.git

clone after success Just follow the normal extension compilation and installation steps.

phpize
./configure
make
make install

Different PHP versions need to install different versions of extensions. At the same time, runkit7 is still under development, and some functions are not yet supported, such as:

  • runkit_class_adopt

  • runkit_class_emancipate

  • runkit_import

  • runkit_lint_file

  • runkit_lint

  • runkit_sandbox_output_handler

  • runkit_return_value_used

  • Runkit_Sandbox

  • Runkit_Sandbox_Parent

When writing the test code for this article, the above functions or classes were not supported. You can use the PHP5 environment to test whether the original extensions can be used normally.

View super global variable keys

print_r(runkit_superglobals());
//Array
//(
//    [0] => GLOBALS
//    [1] => _GET
//    [2] => _POST
//    [3] => _COOKIE
//    [4] => _SERVER
//    [5] => _ENV
//    [6] => _REQUEST
//    [7] => _FILES
//    [8] => _SESSION
//)

This function actually checks all super global variable key names in the current running environment. These are some of our commonly used superglobal variables, so I won’t explain them one by one.

Method operations are the same as constant operations. We can dynamically add, modify, delete and rename various methods. First, let’s take a look at what we are most concerned about when modifying the logic code in the method body during dynamic runtime.

function testme() {
  echo "Original Testme Implementation\n";
}
testme(); // Original Testme Implementation
runkit_function_redefine('testme','','echo "New Testme Implementation\n";');
testme(); // New Testme Implementation

Define a testme() method, and then modify its implementation through runkit_function_redefine(). Finally, when testme() is called again, the output will be the newly modified implementation. So, can we modify the methods that come with PHP?

// php.ini runkit.internal_override=1
runkit_function_redefine('str_replace', '', 'echo "str_replace changed!\n";');
str_replace(); // str_replace changed!

runkit_function_rename ('implode', 'joinArr' );
var_dump(joinArr(",", ['a', 'b', 'c'])); 
// string(5) "a,b,c"


array_map(function($v){
   echo $v,PHP_EOL;
},[1,2,3]);
// 1
// 2
// 3
runkit_function_remove ('array_map');

// array_map(function($v){
//   echo $v;
// },[1,2,3]);
// PHP Fatal error:  Uncaught Error: Call to undefined function array_map()

The comments in the code make it very clear. We only need to set runkit.internal_override=1 in php.ini to dynamically modify the methods and functions that come with PHP. For example, in the first paragraph, we modified the str_replace() method so that it can directly output a paragraph of text. Then we rename implode() to joinArr() so that we can use this joinArr() just like implode(). Finally, we removed the array_map() method. If this method is called again, an error will be reported.

The operation of the internal method function of the class is similar to the operation of the variable method above, but we cannot modify the classes that come with PHP. operation. You can try this yourself.

//runkit_method_add('PDO', 'testAddPdo', '', 'echo "This is PDO new Func!\n";');
//PDO::testAddPdo();
// PHP Warning:  runkit_method_add(): class PDO is not a user-defined class

It can be seen from the error message that the PDO class is not a user-defined class, so the runkit function cannot be used for related operations. Then let's take a look at how our custom classes use runkit to perform dynamic operations.

class Example{
}

runkit_method_add('Example', 'func1', '', 'echo "This is Func1!\n";');
runkit_method_add('Example', 'func2', function(){
    echo "This is Func2!\n";
});
$e = new Example;
$e->func1(); // This is Func1!
$e->func2(); // This is Func2!

runkit_method_redefine('Example', 'func1', function(){
    echo "New Func1!\n";
});
$e->func1(); // New Func1!

runkit_method_rename('Example', 'func2', 'func22');
$e->func22(); // This is Func2!

runkit_method_remove('Example', 'func1');
//$e->func1();
// PHP Fatal error:  Uncaught Error: Call to undefined method Example::func1()

We defined an empty class, then dynamically added two methods to it, then modified method 1, renamed method 2, and finally deleted method 1. The series of operations are actually the same as above The operation of the ordinary method is basically the same.

Summary

As mentioned above, this extension is a relatively dangerous extension, especially if runkit.internal_override is turned on, we can also modify it PHP native functions. But if you must use it, then its functions are very useful. Just like the visitor pattern, "most of the time you don't need the visitor pattern, but when you need the visitor pattern, you really need it." The same is true for this set of runkit extensions.

推荐学习:php视频教程

测试代码:

https://github.com/zhangyue0503/dev-blog/blob/master/php/202006/source/%E4%B8%80%E8%B5%B7%E5%AD%A6%E4%B9%A0PHP%E7%9A%84runkit%E6%89%A9%E5%B1%95%E5%A6%82%E4%BD%95%E4%BD%BF%E7%94%A8.php

The above is the detailed content of How to use runkit extension in PHP. For more information, please follow other related articles on the PHP Chinese website!

Statement
This article is reproduced at:segmentfault. If there is any infringement, please contact admin@php.cn delete
ACID vs BASE Database: Differences and when to use each.ACID vs BASE Database: Differences and when to use each.Mar 26, 2025 pm 04:19 PM

The article compares ACID and BASE database models, detailing their characteristics and appropriate use cases. ACID prioritizes data integrity and consistency, suitable for financial and e-commerce applications, while BASE focuses on availability and

PHP Secure File Uploads: Preventing file-related vulnerabilities.PHP Secure File Uploads: Preventing file-related vulnerabilities.Mar 26, 2025 pm 04:18 PM

The article discusses securing PHP file uploads to prevent vulnerabilities like code injection. It focuses on file type validation, secure storage, and error handling to enhance application security.

PHP Input Validation: Best practices.PHP Input Validation: Best practices.Mar 26, 2025 pm 04:17 PM

Article discusses best practices for PHP input validation to enhance security, focusing on techniques like using built-in functions, whitelist approach, and server-side validation.

PHP API Rate Limiting: Implementation strategies.PHP API Rate Limiting: Implementation strategies.Mar 26, 2025 pm 04:16 PM

The article discusses strategies for implementing API rate limiting in PHP, including algorithms like Token Bucket and Leaky Bucket, and using libraries like symfony/rate-limiter. It also covers monitoring, dynamically adjusting rate limits, and hand

PHP Password Hashing: password_hash and password_verify.PHP Password Hashing: password_hash and password_verify.Mar 26, 2025 pm 04:15 PM

The article discusses the benefits of using password_hash and password_verify in PHP for securing passwords. The main argument is that these functions enhance password protection through automatic salt generation, strong hashing algorithms, and secur

OWASP Top 10 PHP: Describe and mitigate common vulnerabilities.OWASP Top 10 PHP: Describe and mitigate common vulnerabilities.Mar 26, 2025 pm 04:13 PM

The article discusses OWASP Top 10 vulnerabilities in PHP and mitigation strategies. Key issues include injection, broken authentication, and XSS, with recommended tools for monitoring and securing PHP applications.

PHP XSS Prevention: How to protect against XSS.PHP XSS Prevention: How to protect against XSS.Mar 26, 2025 pm 04:12 PM

The article discusses strategies to prevent XSS attacks in PHP, focusing on input sanitization, output encoding, and using security-enhancing libraries and frameworks.

PHP Interface vs Abstract Class: When to use each.PHP Interface vs Abstract Class: When to use each.Mar 26, 2025 pm 04:11 PM

The article discusses the use of interfaces and abstract classes in PHP, focusing on when to use each. Interfaces define a contract without implementation, suitable for unrelated classes and multiple inheritance. Abstract classes provide common funct

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Best Graphic Settings
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. How to Fix Audio if You Can't Hear Anyone
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
WWE 2K25: How To Unlock Everything In MyRise
1 months agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

SecLists

SecLists

SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

DVWA

DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software

SAP NetWeaver Server Adapter for Eclipse

SAP NetWeaver Server Adapter for Eclipse

Integrate Eclipse with SAP NetWeaver application server.