ereg正则%00截断

 1 <?php
 2 $flag = "xxx";
 3 if (isset ($_GET[‘password‘]))
 4 {
 5 if (ereg ("^[a-zA-Z0-9]+$", $_GET[‘password‘]) === FALSE)
 6 {
 7 echo ‘
 8 
 9 You password must be alphanumeric
10 
11 ‘;
12 }
13 else if (strlen($_GET[‘password‘]) < 8 && $_GET[‘password‘] > 9999999)
14 {
15 if (strpos ($_GET[‘password‘], ‘*-*‘) !== FALSE) //strpos — 查找字符串首次出现的位置
16 {
17 die(‘Flag: ‘ . $flag);
18 }
19 else
20 {
21 echo(‘
22 
23 - have not been found
24 
25 ‘);
26 }
27 }
28 else
29 {
30 echo ‘
31 
32 Invalid password
33 
34 ‘;
35 }
36 }
37 ?>