直接看代码
<?php echo ‘1‘.print(2)+3,"\n";
不错，就是这么简单，但是很少有人能正确回答
我们执行一下
[root@localhost test]# php -dvld.active=1 test7.php
Finding entry points
Branch analysis from position: 0
Jump found. Position 1 = -2
filename: /data/www/test/test7.php
function name: (null)
number of ops: 6
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
2 0 E > ADD ~0 2, 3
1 PRINT ~1 ~0
2 CONCAT ~2 ‘1‘, ~1
3 ECHO ~2
4 ECHO ‘%0A‘
3 5 > RETURN 1
branch: # 0; line: 2- 3; sop: 0; eop: 5; out1: -2
path #1: 0,
511
让人很诧异吧
换一种写法
<?php echo ‘1‘,print(2)+3,"\n";
执行结果
[root@localhost test]# php -dvld.active=1 test7.php
Finding entry points
Branch analysis from position: 0
Jump found. Position 1 = -2
filename: /data/www/test/test7.php
function name: (null)
number of ops: 6
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
2 0 E > ECHO ‘1‘
1 ADD ~0 2, 3
2 PRINT ~1 ~0
3 ECHO ~1
4 ECHO ‘%0A‘
3 5 > RETURN 1
branch: # 0; line: 2- 3; sop: 0; eop: 5; out1: -2
path #1: 0,
151
再换一种
<?php echo print(2)+3,"\n";
执行结果
[root@localhost test]# php -dvld.active=1 test7.php
Finding entry points
Branch analysis from position: 0
Jump found. Position 1 = -2
filename: /data/www/test/test7.php
function name: (null)
number of ops: 5
compiled vars: none
line #* E I O op fetch ext return operands
-------------------------------------------------------------------------------------
2 0 E > ADD ~0 2, 3
1 PRINT ~1 ~0
2 ECHO ~1
3 ECHO ‘%0A‘
3 4 > RETURN 1
branch: # 0; line: 2- 3; sop: 0; eop: 4; out1: -2
path #1: 0,
51
未完待续……
原文：http://www.cnblogs.com/chenpingzhao/p/4684694.html