您可以使用 tokenizer 为此:

print_r(token_get_all('<?php exec("rm -rf *"); ?>'));

在输出中注意第三个元素:

Notice in the output the third element which is:

[1] => Array
    (
        [0] => 307
        [1] => exec
        [2] => 1
    )