Add PHP as a vulnerable language

PHP/README.md

@@ -0,0 +1,17 @@
+# PHP
+
+## Commenting-Out
+
+- Confirmed working PHP 8.0.13 and 8.1.0-RC6 (Ubuntu)
+
+## Stretched String
+
+- Confirmed working PHP 8.0.13 and 8.1.0-RC6 (Ubuntu)
+
+## Invisible Functions
+
+- Confirmed working PHP 8.0.13 and 8.1.0-RC6 (Ubuntu)
+
+## Homoglyph Function
+
+- Confirmed working PHP 8.0.13 and 8.1.0-RC6 (Ubuntu)

PHP/commenting-out.php

@@ -0,0 +1,6 @@
+#!/usr/bin/env php
+<?php
+$isAdmin = false;
+/*‮ } ⁦if ($isAdmin)⁩ ⁦ begin admins only */
+    echo "You are an admin.";
+/* end admins only ‮ { ⁦*/

PHP/homoglyph-function.php

@@ -0,0 +1,12 @@
+#!/usr/bin/env php
+<?php
+
+function sayHello() {
+    echo "Hello, World!\n";
+}
+
+function sayНello() {
+    echo "Goodbye, World!\n";
+}
+
+sayНello();

PHP/invisible-function.php

@@ -0,0 +1,16 @@
+#!/usr/bin/env php
+<?php
+
+function isAdmin() {
+    return false;
+}
+
+function is​Admin() {
+    return true;
+}
+
+if (is​Admin()) {
+    echo "You are an admin\n";
+} else {
+    echo "You are NOT an admin.\n";
+}

PHP/stretched-string.php

@@ -0,0 +1,6 @@
+#!/usr/bin/env php
+<?php
+$accessLevel = "user";
+if ($accessLevel != "user‮ ⁦// Check if admin⁩ ⁦") {
+    echo "You are an admin.";
+}