Last week Joe Stagner, a senior program manager in Microsoft's Developer Tools and Platforms group published findings of his benchmark tests intended to reveal how well ASP.NET and PHP code run on ...

This data is modified in such a way to force the TCPDF library to call the PHP server's "phar://" stream wrapper, and later abuse the PHP deserialization process to run code on the underlying server.

One of PHP's strengths is the ability to easily inject variables, values and attributes into HTML code to create dynamic Web pages.