php代码审计总结

<?php$a=$_GET['a'];if(stripos($a,'.')){    echo 'no';    return ;}$data = @file_get_contents($a,'r');if($data=="WHT is a good family!"){    require("flag.txt");    echo "flag";}?>

<?php $flag='flag.txt';extract($_GET); if(isset($a)) {    $content=trim(file_get_contents($flag));    //将flag文件的内容赋值给content变量    if($a==$content)    {        echo'ctf{xxx}';    }   else   {    echo'no';   }   } ?>

<?php $flag = "flag{xxxx}"; session_start();if (isset ($_GET['password'])) {    if ($_GET['password'] == $_SESSION['password'])        die ('Flag: '.$flag);    else        print 'Wrong';}mt_srand((microtime() ^ rand(1, 10000)) % rand(1, 10000) + rand(1, 10000));?>

<?php error_reporting(0);$flag = "flag{test}"; $temp = $_GET['password'];is_numeric($temp)?die("no numeric");   if($temp>1336){    echo $flag;} ?>

$password = $_GET['password'];$sql = "SELECT * FROM users WHERE password = '".md5($password,true)."'";

<?php $flag = "flag{xxxx}"; if (isset($_GET['name']) and isset($_GET['password'])){    if ($_GET['name'] == $_GET['password'])        echo 'Your password can not be your name!';    else if (sha1($_GET['name']) === sha1($_GET['password']))      die('Flag: '.$flag);    else        echo 'Invalid password.';}else    echo 'Login first!';?>