false => ![]
true => !![]
undefined => [][[]]
NaN => +[![]]
0 => +[]
1 => +!+[]
2 => !+[]+!+[]
10 => [+!+[]]+[+[]]
Array => []
Number => +[]
String => []+[]
Boolean => ![]
Function => []["filter"]
eval => []["filter"]["constructor"]( CODE )()
window => []["filter"]["constructor"]("return this")()
Just about anything javascript can be turned into incredibly hard to read crap if you use those conversions. It is stupid, but it can be done.
So take the 10 for example:
[+!+[]]+[+[]]
This is really two components:
[+!+[]]
and
[+[]]
This is just [1]
and [0]
. But if we add them together, they are cast to strings, so we get "1" + "0" which gives us "10".
For your question:
+((!+[] + !![] + !![] + !![] + []) + (!+[] + !![] + !![] + !![] + !![] + !![] + !![]));
I'll break down the 4 component:
(!+[] + !![] + !![] + !![] + [])
true + true + true + true + array
which if you run it in the console, gives you 4. The last [] does nothing for this part, but it forces the typecast to string, which is important for the next part.
Then, the next one becomes
true + true + true + true + true + true + true
which gives you 7.
So you get 4 + [] + 7, which makes "47" since the + [] +
forces the typecast to string.
To do it in PHP, you could do something like:
$x = (![] + ![] + ![] + ![]) . (![] + ![] + ![] + ![] + ![] + ![] + ![]);
//$x is now 47