PHP \u662f\u4ec0\u4e48\uff1f<\/strong><\/p>\n PHP \u6587\u4ef6\u901a\u5e38\u5305\u542b HTML \u6807\u7b7e\u548c\u4e00\u4e9b PHP \u811a\u672c\u4ee3\u7801\uff0c\u4e0b\u9762\u5c06\u8f93\u51fa php\u53d8\u91cf\u4f5c\u7528\u57df\uff1a<\/p>\n echo \u548c print \u533a\u522b:<\/p>\n echo \u662f\u4e00\u4e2a\u8bed\u8a00\u7ed3\u6784\uff0c\u4f7f\u7528\u7684\u65f6\u5019\u53ef\u4ee5\u4e0d\u7528\u52a0\u62ec\u53f7\uff0c\u4e5f\u53ef\u4ee5\u52a0\u4e0a\u62ec\u53f7\uff1a echo \u6216 echo()\u3002<\/p>\n print \u540c\u6837\u662f\u4e00\u4e2a\u8bed\u8a00\u7ed3\u6784\uff0c\u53ef\u4ee5\u4f7f\u7528\u62ec\u53f7\uff0c\u4e5f\u53ef\u4ee5\u4e0d\u4f7f\u7528\u62ec\u53f7\uff1a print \u6216 print()\u3002<\/p>\n PHP EOF(heredoc)\u662f\u4e00\u79cd\u5728\u547d\u4ee4\u884cshell\uff08\u5982sh\u3001csh\u3001ksh\u3001bash\u3001PowerShell\u548czsh\uff09\u548c\u7a0b\u5e8f\u8bed\u8a00\uff08\u50cfPerl\u3001PHP\u3001Python\u548cRuby\uff09\u91cc\u5b9a\u4e49\u4e00\u4e2a\u5b57\u7b26\u4e32\u7684\u65b9\u6cd5\u3002<\/p>\n \u4f7f\u7528\u6982\u8ff0\uff1a<\/p>\n \u5b57\u7b26\u4e32\u548c\u6570\u5b57\u6bd4\u8f83\uff0c\u5b57\u7b26\u4e32\u4f1a\u88ab\u8f6c\u6362\u6210\u6570\u5b570\u3002<\/p>\n \u6df7\u5408\u5b57\u7b26\u4e32\u8f6c\u6362\u6210\u6570\u5b57\uff0c\u770b\u5b57\u7b26\u4e32\u7684\u7b2c\u4e00\u4e2a\u3002<\/p>\n \u5b57\u7b26\u4e32\u5f00\u5934\u4ee5xex\u5f00\u5934\uff0cx\u4ee3\u8868\u6570\u5b57\u3002\u4f1a\u88ab\u8f6c\u6362\u6210\u79d1\u5b66\u8ba1\u6570\u6cd5\u3002<\/p>\n \u5e94\u7528\u4e3e\u4f8b\uff1a<\/p>\n strcmp() \u51fd\u6570\u6bd4\u8f83\u4e24\u4e2a\u5b57\u7b26\u4e32\u3002<\/p>\n \u6ce8\u91ca\uff1a<\/strong>strcmp() \u51fd\u6570\u662f\u4e8c\u8fdb\u5236\u5b89\u5168\u7684\uff0c\u4e14\u533a\u5206\u5927\u5c0f\u5199\u3002<\/p>\n \u8bed\u6cd5:<\/strong><\/p>\n string1 \u5fc5\u9700\u3002\u89c4\u5b9a\u8981\u6bd4\u8f83\u7684\u7b2c\u4e00\u4e2a\u5b57\u7b26\u4e32\u3002<\/p>\n string2 \u5fc5\u9700\u3002\u89c4\u5b9a\u8981\u6bd4\u8f83\u7684\u7b2c\u4e8c\u4e2a\u5b57\u7b26\u4e32\u3002<\/p>\n \u8fd4\u56de\u503c:<\/strong><\/p>\n \u6f0f\u6d1e\u539f\u7406\uff1a<\/strong><\/p>\n \u5728php 5.2\u7248\u672c\u4e4b\u524d\uff0c\u5229\u7528strcmp\u51fd\u6570\u5c06\u6570\u7ec4\u4e0e\u5b57\u7b26\u4e32\u8fdb\u884c\u6bd4\u8f83\u4f1a\u8fd4\u56de-1\uff0c\u4f46\u662f\u4ece5.3\u5f00\u59cb\uff0c\u4f1a\u8fd4\u56de0<\/p>\n \u548c\u4e0a\u9762\u7c7b\u4f3c\uff1a<\/p>\n \u7ed5\u8fc7\u65b9\u5f0f<\/strong> \u7ed5\u8fc7\u65b9\u5f0f<\/strong> \u5b57\u7b26\u8981\u7528json\u683c\u5f0f\u53bb\u7f16\u5199\uff0c\u8fd9\u91cc\u8bbe\u5b9a\u540d\u79f0\u4e3aflag\uff0c\u4f20\u5165\u6570\u5b57\u65f6\uff0c\u5b83\u4f1a\u8f6c\u5316\u4e3a\u540c\u4e00\u7c7b\u578b\u8fdb\u884c\u6bd4\u8f83\uff0c\u8fd9\u91cc\u5b57\u7b26\u88ab\u8f6c\u4e3a0\uff0c\u6211\u4eec\u4f20\u5165\u7684\u53c2\u6570\u4e3a0\uff0c\u6240\u4ee5\u76f8\u7b49\u3002<\/p>\n \u51fd\u6570\u683c\u5f0f in_array(\u9700\u8981\u5728\u6570\u7ec4\u5185\u641c\u7d22\u7684\u6570\u503c,\u88ab\u641c\u7d22\u7684\u6570\u7ec4,\u4e00\u4e2a\u53ef\u9009\u53c2\u6570\uff0c\u8bbe\u7f6eTURE\u68c0\u67e5\u6570\u636e\u548c\u6570\u7ec4\u503c\u7c7b\u578b\u662f\u5426\u76f8\u540c)<\/p>\n \u7ed5\u8fc7\u65b9\u5f0f<\/strong> \u8be5\u51fd\u6570\u7684\u4f5c\u7528\u662f\u5728\u6570\u7ec4\u4e2d\u641c\u7d22\u67d0\u4e2a\u952e\u503c\uff0c\u5e76\u8fd4\u56de\u952e\u540d<\/p>\n \u7ed5\u8fc7\u65b9\u5f0f<\/strong> \u548c\u524d\u9762in_array\u4e00\u6837\uff0c\u5f53\u6ca1\u6709\u8bbe\u5b9a\u68c0\u6d4b\u53c2\u6570\u4e3atrue\u65f6\uff0c\u4f1a\u8fdb\u884c\u677e\u6563\u6bd4\u8f83\uff0c\u4f1a\u628a\u6570\u636e\u7c7b\u578b\u8fdb\u884c\u8f6c\u6362\uff0c\u7136\u540e\u6267\u884c<\/p>\n \u8be5\u51fd\u6570\u7528\u4e8e\u83b7\u53d6\u53d8\u91cf\u7684\u6574\u6570\u503c<\/p>\n \u7ed5\u8fc7\u65b9\u6cd5\uff1a<\/strong> \u8fd9\u4e2a\u51fd\u6570\u7528\u4e8e\u68c0\u6d4b\u53d8\u91cf\u662f\u5426\u53ea\u7531\u6570\u5b57\u7ec4\u6210\uff0c\u5426\u5219\u8fd4\u56defalse<\/p>\n \u7ed5\u8fc7\u65b9\u6cd5<\/strong><\/p>\n \u5f53\u4f20\u5165\u6570\u5b57\u5f00\u5934\uff0c\u5b57\u6bcd\u5728\u540e\u7684\u5b57\u7b26\u4e32\u65f6\uff0c\u53c2\u6570\u53ef\u4ee5\u7ed5\u8fc7\u67d0\u4e9b\u68c0\u6d4b\uff0c\u4ece\u800c\u8fdb\u884c\u5230\u4e0b\u4e00\u6b65\uff0c\u800cphp\u5904\u7406\u4e0d\u540c\u5b57\u7b26\u4e32\u65f6\u53c8\u4f1a\u628a\u4e24\u4e2a\u5b57\u7b26\u4e32\u8f6c\u6362\u5230\u540c\u4e00\u7c7b\u578b\u53bb\u5904\u7406<\/p>\n strpos\u51fd\u6570\u7528\u4e8e\u67e5\u627e\u76ee\u6807\u5b57\u7b26\u5728\u5b57\u7b26\u4e32\u4e2d\u51fa\u73b0\u7684\u7b2c\u4e00\u6b21\u7684\u4f4d\u7f6e<\/p>\n \u7ed5\u8fc7\u65b9\u6cd5<\/strong> \u8fd9\u91cc\u901a\u8fc7\u6570\u7ec4\u7684\u5f62\u5f0f\u53bb\u4f20\u5165\u4e00\u4e2a\u6570\u5b57\uff0c\u9996\u5148\u7ed5\u8fc7\u7b2c\u4e00\u9053\u68c0\u6d4b\uff0c\u7136\u540e\u5728\u7b2c\u4e8c\u5904strpos\u68c0\u6d4b\u65f6\uff0c\u901a\u8fc7\u6570\u7ec4\u53bb\u7ed5\u8fc7\uff0c\u76f4\u63a5\u8fd4\u56denull\uff0c\u4ece\u800c\u7ed5\u8fc7<\/p>\n \u6240\u8c13MD5\u5f3a\u7c7b\u578b\u7ed5\u8fc7\uff0c\u5176\u5b9e\u5c31\u662fMD5\u5f3a\u78b0\u649e\u4ea7\u751f\u7684\u5f02\u7c7b\u3002<\/p>\n\n
php\u57fa\u7840\u6846\u67b6\u4e0e\u8bed\u6cd5<\/h2>\n
php\u57fa\u7840\u6846\u67b6\uff1a<\/h3>\n
\/\/\u6587\u4ef6\u6269\u5c55\u540d\u4e3a .php\n<? php\n\/\/php code\n?><\/code><\/pre>\nhello world<\/code>\uff1a<\/p>\n<!DOCTYPE HTML>\n<html>\n <title>\n PHP\n <\/title>\n <body>\n <h1>PHP learn!<\/h1>>\n <?php\n echo "Hello World!";\n ?>\n <\/body>\n<\/html><\/code><\/pre>\n![\"image-20220731143704691\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326409.png\")
<\/div><\/p>\nphp\u53d8\u91cf<\/h3>\n
\n
$y<\/code> \u548c $Y<\/code> \u662f\u4e24\u4e2a\u4e0d\u540c\u7684\u53d8\u91cf\uff09<\/li>\n<\/ul>\n<?php\n$a = 1;\n$b = 2;\n$c = $a + $b;\necho $c;\n?>\n\/\/\u4f1a\u6253\u53703<\/code><\/pre>\n\n
<?php\n $a = 1;\n$c = 0;\nfunction Test(){\n $b = 10;\n global $a,$c;\n $c = $b + $a;\n \/\/ echo $c;\n static $d = 12;\n echo $d++ ."<\/br>";\n}\nTest();\nTest();\nTest();\necho "c\u4e3a\uff1a\uff1a".$c;\n?><\/code><\/pre>\n![\"image-20220731160308897\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326411.png\")
<\/div><\/p>\nphp5 \u7684 echo \u4e0e print<\/h3>\n
\n
<?php\n$a = 1;\n$c = 0;\necho $a + $c;\necho "<br\/>"; \/\/\u6362\u884c\necho ($a + $c);\necho ("<br\/>"); \/\/\u6362\u884c\nprint($a + $c);\nprint("<br\/>"); \/\/\u6362\u884c\nprint $a + $c;\nprint "<br\/>"; \/\/\u6362\u884c\n?>\n\/\/\u8f93\u51fa1111<\/code><\/pre>\nPHP EOF(heredoc)<\/h3>\n
\n
<?php\n$name="h13k";\n$a= <<<EOF\n "name:"$name\n "attack!!!"\nEOF;\n\/\/ \u7ed3\u675f\u9700\u8981\u72ec\u7acb\u4e00\u884c\u4e14\u524d\u540e\u4e0d\u80fd\u7a7a\u683c\necho $a;\n?>\n\/\/\u8f93\u51fa"name:"h13k "attack!!!"<\/code><\/pre>\nPHP\u6570\u636e\u7c7b\u578b<\/h3>\n
\n
<?php\n$string = "Hello World!";\n$integer = 123456789;\n$float = 12345.6789;\n$bool = True;\n$array = array("web", "pwn", "reverse", "misc", "crypto", 1, 2, 3, 4, 5);\n\nclass ACM\n{\n var $algorithm;\n\n function __construct($algorithm = "basic")\n {\n $this->algorithm = $algorithm;\n }\n\n function how_to_learn_acm()\n {\n return $this->algorithm;\n }\n}\n\n$NULL = null;\nvar_dump($string);\necho "<br\/>";\nvar_dump($integer);\necho "<br\/>";\nvar_dump($float);\necho "<br\/>";\nvar_dump($bool);\necho "<br\/>";\nvar_dump($array);\necho "<br\/>";\n?>\n\/\/string(12) "Hello World!"\n\/\/int(123456789)\n\/\/float(12345.6789)\n\/\/bool(true)\n\/\/array(10) { [0]=> string(3) "web" [1]=> string(3) "pwn" [2]=> string(7) "reverse" [3]=> string(4) "misc" [4]=> string(6) "crypto" [5]=> int(1) [6]=> int(2) [7]=> int(3) [8]=> int(4) [9]=> int(5) }<\/code><\/pre>\nPHP\u7c7b\u578b\u6bd4\u8f83<\/h3>\n
\n
==<\/code> \u6bd4\u8f83\uff0c\u53ea\u6bd4\u8f83\u503c\uff0c\u4e0d\u6bd4\u8f83\u7c7b\u578b\u3002<\/li>\n===<\/code>\u6bd4\u8f83\uff0c\u9664\u4e86\u6bd4\u8f83\u503c\uff0c\u4e5f\u6bd4\u8f83\u7c7b\u578b\u3002<\/li>\n<\/ul>\n![\"image-20220731171104479\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326412.png\")
<\/div>
\n![\"image-20220731171401620\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326413.png\")
<\/div>
\n![\"image-20220731171426171\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326414.png\")
<\/div>
\n![\"image-20220731171440560\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326415.png\")
<\/div>
\n![\"image-20220731171452629\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326416.png\")
<\/div><\/p>\nctf\u4e2d\u7684php\u5f31\u7c7b\u578b\u6bd4\u8f83\u4ee5\u53ca\u76f8\u5173\u6f0f\u6d1e<\/h3>\n
\n
\n
admin\u201d==0 \/\/true<\/code><\/pre>\n<\/li>\n<\/ul>\n<\/li>\n\n
'1admin' == 1\n'2admin' == 2<\/code><\/pre>\n<\/li>\n<\/ul>\n<\/li>\n\n
'2e2'=2*10^2=200\n\"-2e2\"=-2*10^2 \"0e2\"=0*10^2=0 \n\"hh-2e2\"=0\n\"1hh-2e2\"=1<\/code><\/pre>\n<\/li>\n<\/ul>\nif (md5($Username) != md5($password)) {$logined = false;}\n==>md5('240610708') == md5('QNKCDZO')\n<?php\nvar_dump(\u20180e45511255\u2019 == \u20180e1455155\u2019);\nvar_dump(\u20180e45511255\u2019 == \u20180\u2019);\n?>\n\/\/bool(true) bool(true)\n0e\u5f00\u5934\u7684md5\u548c\u539f\u503c\uff1a\ns878926199a ==> 0e545993274517709034328855841020\ns155964671a ==> 0e342768416822451524974117254469\ns214587387a ==> 0e848240448830537924465865611904\ns214587387a ==> 0e848240448830537924465865611904\ns878926199a ==> 0e545993274517709034328855841020\ns1091221200a ==> 0e940624217856561557816327384675\ns1885207154a ==> 0e509367213418206700842008763514\ns1502113478a ==> 0e861580163291561247404381396064\ns1885207154a ==> 0e509367213418206700842008763514\ns1836677006a ==> 0e481036490867661113260034900752\ns155964671a ==> 0e342768416822451524974117254469\ns1184209335a ==> 0e072485820392773389523109082030\ns1665632922a ==> 0e731198061491163073197128363787\ns1502113478a ==> 0e861580163291561247404381396064\ns1836677006a ==> 0e481036490867661113260034900752\ns1091221200a ==> 0e940624217856561557816327384675\ns155964671a ==> 0e342768416822451524974117254469\ns1502113478a ==> 0e861580163291561247404381396064\ns155964671a ==> 0e342768416822451524974117254469\ns1665632922a ==> 0e731198061491163073197128363787\ns155964671a ==> 0e342768416822451524974117254469\ns1091221200a ==> 0e940624217856561557816327384675\ns1836677006a ==> 0e481036490867661113260034900752\ns1885207154a ==> 0e509367213418206700842008763514\ns532378020a ==> 0e220463095855511507588041205815\ns878926199a ==> 0e545993274517709034328855841020\ns1091221200a ==> 0e940624217856561557816327384675\ns214587387a ==> 0e848240448830537924465865611904\ns1502113478a ==> 0e861580163291561247404381396064\ns1091221200a ==> 0e940624217856561557816327384675\ns1665632922a ==> 0e731198061491163073197128363787\ns1885207154a ==> 0e509367213418206700842008763514\ns1836677006a ==> 0e481036490867661113260034900752\ns1665632922a ==> 0e731198061491163073197128363787\ns878926199a ==> 0e545993274517709034328855841020<\/code><\/pre>\nbool\u7c7b\u578b\u7684true\u8ddf\u4efb\u610f\u5b57\u7b26\u4e32\u53ef\u4ee5\u5f31\u7c7b\u578b\u76f8\u7b49<\/h4>\n
<?php\nif ( true=\u201cH1TerHub\u201d){\necho "success";\n}<\/code><\/pre>\nStrcmp\u51fd\u6570\u7684\u6f0f\u6d1e<\/h4>\n
strcmp(string1,string2)<\/code><\/pre>\n\n
<?php\n $password="***************";\n if(isset($_GET['password'])){\n if(strcmp($_GET['password'],$password)==0){\n echo "flag{xxxxx-xxx-xxxx}";\n }else{\n echo "NO password ";\n }\n }\n?>\n\/\/\u6784\u9020password\u4e3a\u4e00\u4e2a\u6570\u7ec4\u6570\u7ec4\u4f20\u503c\u4e3a1\n\/\/payload:?password[]=1<\/code><\/pre>\nSha1\u51fd\u6570\u7684\u6f0f\u6d1e<\/h4>\n
\/\/url\/check.php?a[]=213\n<?php \nif(sha1($_GET('a')) == 1)\n echo "flag";\n?><\/code><\/pre>\nSwitch\u7ed5\u8fc7<\/h4>\n
\nswitch\u9009\u62e9\u7684\u65f6\u5019\uff0c\u5904\u7406\u7684\u53d8\u91cf\u4f1a\u88ab\u5f3a\u8f6c\u4e3aint\u7c7b\u578b\uff0c\u8fd9\u4e2a\u51fd\u6570\u4e00\u822c\u7528\u4e8e\u6839\u636e\u591a\u4e2a\u6761\u4ef6\u9009\u62e9\u6267\u884c\u4e0d\u540c\u52a8\u4f5c\uff0c\u548cif\u2026. else<\/code>\u76f8\u4f3c<\/p>\n<?php\n $a=$_GET['$a'];\nswitch ($a) {\n case 1:\n echo "error";\n break;\n case 2:\n echo "error2";\n break;\n case 3:\n echo "error3";\n break;\n case 4:\n echo "233";\n break;\n}\n?>\n\/\/\u8f93\u51657sadshsajkhdsah\n\/\/\u8fd4\u56de7<\/code><\/pre>\njson\u7ed5\u8fc7<\/h4>\n
json_decode()<\/code>\u8fd9\u4e2a\u51fd\u6570\u7528\u4e8e\u89e3\u7801json\u683c\u5f0f\u7684\u5b57\u7b26\u4e32<\/p>\n
\n\u5f53\u6709\u4e0d\u540c\u7c7b\u578b\u7684\u6570\u636e\u65f6\uff0c\u8be5\u51fd\u6570\u4f1a\u8f6c\u6362\u4e3a\u540c\u4e00\u7c7b\u578b\u6bd4\u8f83\uff0c\u8fd9\u91cc\u4f1a\u628a\u539f\u6709\u7684\u6570\u636e\u7684\u6570\u636e\u7c7b\u578b\u8f6c\u6362\u4e3a\u548c\u4f20\u5165\u6570\u636e\u7684\u6570\u636e\u7c7b\u578b\u76f8\u540c<\/p>\n<?php\nif (isset($_GET['m'])) {\n $m = json_decode($_GET['m']);\n $flag ="dfdfgdg";\n if ($m->flag == $flag) {\n echo "233";\n }\n else {\n echo "haha";\n }\n}\nelse{\n echo "hahaha";\n}\n?><\/code><\/pre>\n![\"image-20220801190340384\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326417.png\")
<\/div><\/p>\nin_array\u51fd\u6570<\/h4>\n
\n\u8fd9\u4e2a\u51fd\u6570\u7684\u4f5c\u7528\u662f\u68c0\u67e5\u6570\u7ec4\u4e2d\u662f\u5426\u5b58\u5728\u67d0\u4e2a\u503c\uff0c\u5f53\u6ca1\u6709\u6700\u540e\u7684\u68c0\u6d4b\u53c2\u6570\u4e3atrue\u65f6\uff0c\u9ed8\u8ba4\u4e3a\u677e\u6563\u6bd4\u8f83\uff0c\u5bfc\u81f4\u5f31\u7c7b\u578b\uff0c\u4f20\u5165\u4e0d\u540c\u6570\u636e\u7c7b\u578b\u6765\u7ed5\u8fc7<\/p>\n<?php\n$array=[1,2,3];\nvar_dump(in_array('aaa', $array)); \nvar_dump(in_array('1aa', $array));\n?>\n\/\/bool(false)bool(true)<\/code><\/pre>\narray_search()\u51fd\u6570<\/h4>\n
\n1.\u4f20\u5165\u4e0d\u540c\u6570\u636e\u7c7b\u578b\u6765\u7ed5\u8fc7\uff0c\u6ca1\u6709\u6700\u540e\u7684\u68c0\u6d4b\u53c2\u6570\u4e3atrue\u65f6\uff0c\u9ed8\u8ba4\u4e3a\u677e\u6563\u6bd4\u8f83\uff0c\u5bfc\u81f4\u5f31\u7c7b\u578b
\n2.\u5f53\u6570\u636e\u7c7b\u578b\u4e0d\u540c\u4f1a\u5148\u628a\u539f\u6709\u6570\u636e\u7684\u6570\u636e\u7c7b\u578b\u7684\u8fdb\u884c\u8f6c\u6362\uff0c\u5bfc\u81f4\u5f31\u7c7b\u578b\u7684\u4ea7\u751f<\/p>\n<?php\n$array=[1,1];\nvar_dump(array_search('aaa', $array)); \nvar_dump(array_search('1aa', $array));\n?>\n\/\/bool(false)int(0)<\/code><\/pre>\nintval() \u51fd\u6570<\/h4>\n
\n\u8be5\u51fd\u6570\u5904\u7406\u672c\u8eab\u4e0d\u80fd\u5904\u7406\u7684\u5b57\u7b26\u4e32\u65f6\u5e76\u4e0d\u4f1a\u62a5\u9519\uff0c\u76f4\u63a5\u8fd4\u56de0\uff0c\u5f53\u51fd\u6570\u5185\u6709\u5176\u4ed6\u7684\u64cd\u4f5c\u65f6\uff0c\u4f1a\u628a\u5b57\u7b26\u4e32\u8fd9\u4e9b\u8f6c\u4e3a\u6570\u5b57\u7c7b\u578b\u518d\u64cd\u4f5c\uff0c\u800c\u4e14\u5728\u5904\u7406\u4e00\u4e9b\u7279\u6b8a\u6570\u636e\u7684\u65f6\u5019\u4f1a\u6709\u4e0d\u540c\u7684\u5904\u7406\u7ed3\u679c<\/p>\n<?php\n @$a=$_GET['a'];\nif(intval($a) < 2000 && intval($a +1) >2050){\n echo "hahahah";\n}\nelse\n{\n echo "233";\n}\n?><\/code><\/pre>\n<?php\necho intval(25); \/\/25\necho '<br\/>';\necho intval(2.5); \/\/2\necho '<br\/>';\necho intval('25'); \/\/25\necho '<br\/>';\necho intval('+25'); \/\/25\necho '<br\/>'; \necho intval('-25');\/\/-25\necho '<br\/>'; \necho intval(025);\/\/21\necho '<br\/>'; \necho intval('025');\/\/25\necho '<br\/>'; \necho intval(1e10);\/\/1410065408\necho '<br\/>'; \necho intval('1e10');\/\/1\necho '<br\/>'; \necho intval(0x1A);\/\/26\necho '<br\/>'; \necho intval(25000000);\/\/25000000\necho '<br\/>'; \necho intval(250000000000000000000);\/\/2007498752\necho '<br\/>';\necho intval('420000000000000000000');\/\/2147483647\necho '<br\/>';\necho intval(25, 8);\/\/25\necho '<br\/>';\necho intval('0x42');\/\/0\necho '<br\/>';\necho intval(array());\/\/0\necho '<br\/>';\necho intval(array('aaa', 'abb'));\/\/1\necho '<br\/>';\necho intval('aaa', 8);\/\/0\necho '<br\/>';\necho intval('fgh');\/\/0\necho '<br\/>';\necho intval('1e10'+8);\/\/1410065416\necho '<br\/>';\necho intval('0x2000'+8);\/\/8200\n?><\/code><\/pre>\nis_numeric\u51fd\u6570<\/h4>\n
<?php\n@$a="hehehehehe";\n@$temp = $_GET['p'];\nif(is_numeric($temp)){\ndie("hahha");\n}\nelse if($temp>2010) {\n echo $a;\n}\n?><\/code><\/pre>\nstrpos\u51fd\u6570<\/strong><\/h4>\n
\nstrpos\u5728\u5904\u7406\u6570\u7ec4\u65f6\u76f4\u63a5\u8fd4\u56denull\uff0c\u800c\u6ca1\u6709\u8fd4\u56defalse\uff0c\u5bfc\u81f4\u95ee\u9898\u53d1\u751f
\n\u6d4b\u8bd5\u4ee3\u7801<\/p>\n<?php\nif (isset ($_GET['a'])) {\nif(@ereg("^[1-9]+$", $_GET['a']) === FALSE)\necho '\u5fc5\u987b\u8f93\u5165\u6570\u5b57\u624d\u884c'; \nelse if (strpos ($_GET['a'], '#asdafdasdadas') !== FALSE)\ndie("bababab"); \nelse\necho 'hoho';\n}\n?><\/code><\/pre>\neregi()\u51fd\u6570<\/strong><\/h4>\n
\/\/\u5b57\u7b26\u4e32\u5bf9\u6bd4\u89e3\u6790\uff0c\u5f53ereg\u8bfb\u53d6\u5b57\u7b26\u4e32string\u65f6,%00\u540e\u9762\u7684\u5b57\u7b26\u4e32\u4e0d\u4f1a\u4e0d\u4f1a\u88ab\u89e3\u6790\u3002\n#\u8fd9\u91cc a=abcd%001234\uff0c\u53ef\u4ee5\u7ed5\u8fc7\n<?php\n if (ereg ("^[a-zA-Z]+$", $_GET['a']) === FALSE) {\n echo 'You password must be alphabet';\n }\n?>\n\/\/\u5982\u679c\u4f20\u5165\u6570\u7ec4\uff0cereg\u8fd4\u56deNULL<\/code><\/pre>\npreg_match\u51fd\u6570<\/strong><\/h4>\n
\/\/\u5982\u679c\u5728\u8fdb\u884c\u6b63\u5219\u8868\u8fbe\u5f0f\u5339\u914d\u7684\u65f6\u5019\uff0c\u6ca1\u6709\u9650\u5236\u5b57\u7b26\u4e32\u7684\u5f00\u59cb\u548c\u7ed3\u675f(^ \u548c $)\uff0c\u5219\u53ef\u4ee5\u5b58\u5728\u7ed5\u8fc7\u7684\u95ee\u9898.\n$ip = '1.1.1.1 abcd'; \/\/ \u53ef\u4ee5\u7ed5\u8fc7\nif(!preg_match("\/(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)\/",$ip)) {\n die('error');\n} else {\n \/\/ echo('key...')\n}<\/code><\/pre>\npreg_replace\u51fd\u6570<\/strong><\/h4>\n
\/\/preg_replace() \u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u5982\u679c\u5b58\u5728 \/e \u6a21\u5f0f\u4fee\u9970\u7b26\uff0c\u5219\u5141\u8bb8\u4ee3\u7801\u6267\u884c\u3002\n\/\/\u5982\u679c\u6ca1\u6709 \/e \u4fee\u9970\u7b26\uff0c\u53ef\u4ee5\u5c1d\u8bd5 %00 \u622a\u65ad\u3002\n<?php\n preg_replace("\/test\/e",$_GET["nac"],"jutst test");\n?>\n?nac=phpinfo() #\u53ef\u4ee5\u88ab\u6267\u884c<\/code><\/pre>\nextract()\u51fd\u6570<\/strong><\/h4>\n
\/\/extract() \u51fd\u6570\u4ece\u6570\u7ec4\u4e2d\u628a\u53d8\u91cf\u5bfc\u5165\u5230\u5f53\u524d\u7684\u7b26\u53f7\u8868\u4e2d\u3002\n\/\/\u5bf9\u4e8e\u6570\u7ec4\u4e2d\u7684\u6bcf\u4e2a\u5143\u7d20\uff0c\u952e\u540d\u7528\u4e8e\u53d8\u91cf\u540d\uff0c\u952e\u503c\u7528\u4e8e\u53d8\u91cf\u503c\u3002\n<?php \n $auth = '0'; \n \/\/ \u8fd9\u91cc\u53ef\u4ee5\u8986\u76d6$auth\u7684\u53d8\u91cf\u503c\n extract($_GET); \n if($auth == 1){ \n echo "private!"; \n } else{ \n echo "public!"; \n } \n?><\/code><\/pre>\nparse_str()\u51fd\u6570<\/strong><\/h4>\n
\/\/parse_str() \u7684\u4f5c\u7528\u662f\u89e3\u6790\u5b57\u7b26\u4e32\uff0c\u5e76\u6ce8\u518c\u6210\u53d8\u91cf.\n\/\/\u4e0e parse_str() \u7c7b\u4f3c\u7684\u51fd\u6570\u8fd8\u6709 mb_parse_str()\uff0cparse_str() \u5c06\u5b57\u7b26\u4e32\u89e3\u6790\u6210\u591a\u4e2a\u53d8\u91cf\uff0c\n\/\/\u5982\u679c\u53c2\u6570 str \u662f URL \u4f20\u9012\u5165\u7684\u67e5\u8be2\u5b57\u7b26\u4e32(query string)\uff0c\u5219\u5c06\u5b83\u89e3\u6790\u4e3a\u53d8\u91cf\u5e76\u8bbe\u7f6e\u5230\u5f53\u524d\u4f5c\u7528\u57df.\n\n\/\/var.php?var=new \n$var='init'; \nparse_str($_SERVER['QUERY_STRING']);\n\/\/ $var \u4f1a\u53d8\u6210 new\necho $var;<\/code><\/pre>\n$$\u7684\u4f7f\u7528<\/strong><\/h4>\n
\/\/\u5982\u679c\u628a\u53d8\u91cf\u672c\u8eab\u7684 key \u4e5f\u5f53\u53d8\u91cf\uff0c\u4e5f\u5c31\u662f\u4f7f\u7528\u4e86 $$\uff0c\u5c31\u53ef\u80fd\u5b58\u5728\u95ee\u9898\u3002\n\/\/ http:\/\/127.0.0.1\/index.php?_CONFIG=123\n$_CONFIG['extraSecure'] = true;\nforeach(array('_GET','_POST') as $method) {\n foreach($$method as $key=>$value) {\n \/\/ $key == _CONFIG\n \/\/ $$key == $_CONFIG\n \/\/ \u8fd9\u4e2a\u51fd\u6570\u4f1a\u628a $_CONFIG \u53d8\u91cf\u9500\u6bc1\n unset($$key);\n }\n}\nif ($_CONFIG['extraSecure'] == false) {\n echo 'flag {****}';\n}<\/code><\/pre>\nunset()<\/strong><\/h4>\n
unset($bar); \u7528\u6765\u9500\u6bc1\u6307\u5b9a\u7684\u53d8\u91cf\uff0c\u5982\u679c\u53d8\u91cf $bar \u5305\u542b\u5728\u8bf7\u6c42\u53c2\u6570\u4e2d\uff0c\n\u53ef\u80fd\u51fa\u73b0\u9500\u6bc1\u4e00\u4e9b\u53d8\u91cf\u800c\u5b9e\u73b0\u7a0b\u5e8f\u903b\u8f91\u7ed5\u8fc7\u3002<\/code><\/pre>\n\u5f3a\u7c7b\u578b\u7ed5\u8fc7<\/strong><\/h4>\n
![\"image-20220802084901187\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326418.png\")
<\/div><\/p>\n![\"image-20220802085438070\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326419.png\")
<\/div><\/p>\n![\"image-20220802085502027\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326420.png\")
<\/div><\/p>\n![\"image-20220802085523658\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326421.png\")
<\/div><\/p>\n![\"image-20220802085546922\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326422.png\")
<\/div><\/p>\n![\"image-20220802085611265\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326423.png\")
<\/div><\/p>\n![\"image-20220802090552689\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202208021326424.png\")
<\/div><\/p>\n