inject
src
<script src="hook.js"></script>
<?php
// by escaping the payload you won't break this system, haha! :-)
$escaped = preg_replace("/[a-zA-Z0-9]/", "", $_GET['payload']);
?>
<script>
// here you can inject an arbitrary script,
// but I guess you can't do anything, cuz the script can't include a-zA-Z0-9 ! :-)
<?= $escaped ?>
</script>
<h1>inject</h1>
<form>
<input type="text" name="payload" placeholder="your payload here">
<input type="submit" value="GO">
</form>
<h1>src</h1>
<?php highlight_string(file_get_contents(basename(__FILE__))); ?>