The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    MentalJS for PHP

    By Gareth Heyes (@hackvertor)

    Published 13 years 5 months ago • Last updated March 22, 2025 • ⏱️ 2 min read

    ← Back to articles

    I decided to convert MentalJS to PHP so that the parsing can happen server side and maybe even later on allow JavaScript execution inside PHP. I found PHP really slow and has poor support for creating parsers. As an example I found that parsing jQuery in php was around 3.6-4 seconds whereas JavaScript was 100ms, I noticed an improvement when I used .= instead of str = str .str but it's still pretty slow. Adding multi-byte characters was even worse :( mb_substr is so slow it can fail to parse even small amounts of JavaScript. I suppose my code was optimized for JavaScript so there's probably a little bit of work to optimize for PHP. PHP closure support is quite pathetic and feels hacked together since variables defined in a parent function aren't available to a child function which is odd and you have to use the "use" statement in the function definition WTF. But anyway less moaning about PHP.

    The PHP class is available here: MentalJS Class

    Here's how to use it:

    
    $js = new MentalJS;
    echo $js->minify("function      x (    ) {\n\n\n\n\n x      =      1\n3\n\n}");
    
    

    At the moment it supports minifying, parsing, syntax checking and getting a parse tree of the parsed data. In future I may support "execute" to allow JavaScript execution in PHP but before that I need to find ways to speed it up to get it closer to JS parse times. I've also done a simple demo so you can check it out here: MentalJS PHP demo

    ← Back to articles