[huayang]

变量覆盖

extract()

从数组中将变量导入到当前的符号表

<?php
$flag='xxx';
extract($_GET);
 if(isset($shiyan))
 {
    $content=trim($flag);
    if($shiyan==$content)
    {
        echo'ctf{xxx}';
    }
   else
   {
    echo'Oh.no';
   }
   }
?>

$$

可变变量
$var="php";
$$var="jsp";
echo $var;     php
echo $$var;    jsp
echo "$php";   jsp

<?php
$x = $_GET['x'];
eval("var_dump($$x);");
?>

?x=x=phpinfo()

parse_str()仅限于php5.5

把查询字符串解析到变量

[/huayang]

FROM：浅浅淡淡[hellohy]