<?php
//windows环境
$filename=__DIR__.'///4.php';
$filename1=__DIR__.'/5.php/.';
echo $filename."</br>".$filename1;
$data='<?php phpinfo(); ?>';
file_put_contents($filename,$data);
//可以加入$data到文件中
file_put_contents($filename1,$data);
//可以加入$data到文件中
if(file_exists($filename)){
	//file_exists判断为是
	unlink($filname);//不执行删除操作,参数无效
}
if(file_exists($filename1)){
	//file_exists判断为否
	unlink($filname1);//不执行
}
?>

<?php
    error_reporting(0);
    require __DIR__."/lib.php";

    $url = urldecode($_SERVER['REQUEST_URI']);
    $url_query = parse_url($url, PHP_URL_QUERY);

    $params = explode("&", $url_query);
    foreach($params as $param){

        $idx_equal = strpos($param, "=");
        if($idx_equal === false){
            $key = $param;
            $value = "";
        }else{
            $key = substr($param, 0, $idx_equal);
            $value = substr($param, $idx_equal + 1);
        }

        if(strpos($key, "do_you_want_flag") !== false || strpos($value, "yes") !== false){
            die("no hack");
        }
    }

    if(isset($_GET['do_you_want_flag']) && $_GET['do_you_want_flag'] == "yes"){
        die($flag);
    }

    highlight_file(__FILE__);

<?php
   // It's 'I am slowly' problem of 'Solve Me'.
   error_reporting(0);
   require __DIR__.'/lib.php'; 

   $table = 'iamslowly_'.ip2long($_SERVER['REMOTE_ADDR']);
   $answer = $_GET['answer'];

   if(isset($answer)){
       $con = mysqli_connect($sql_host, $sql_username, $sql_password, $sql_dbname)
           or die('SQL server down');

       $result = mysqli_fetch_array(
           mysqli_query($con, "SELECT `count` FROM `{$table}`;")
       );
       if(!isset($result)){
           mysqli_query($con, "CREATE TABLE IF NOT EXISTS `{$table}` (`answer` char(32) NOT NULL, `count` int(4) NOT NULL);");
           $new_answer = md5(sha1('iamslowly_'.mt_rand().'_'.mt_rand().'_'.mt_rand()));
           mysqli_query($con, "INSERT INTO `{$table}` (`answer`,`count`) VALUES ('{$new_answer}',1);");

       }elseif($result['count'] === '12'){
           mysqli_query($con, "DROP TABLE `{$table}`;");
           echo 'Game over';
           goto quit;
       }

<?php
   // It's 'Anti SQLi' problem of 'Solve Me'.
   error_reporting(0);
   $con = mysqli_connect("127.0.0.1", "root", "root","mytest")
           or die('SQL server down');

   $id = $_GET['id'];
   $pw = $_GET['pw'];
   var_dump($pw);
   echo "</br>";
   echo  $id.','.$pw."</br>";
   echo "SELECT * FROM `user` WHERE `id`='{$id}' AND `pwssword`=md5('{$pw}');"."</br>";
   if(isset($id, $pw)){
       preg_match(
           '/\.|\`|"|\'|\\|\xA0|\x0B|0x0C|\t|\r|\n|\0|'.
           '=|<|>|\(|\)|@@|\|\||&&|#|\/\*.*\*\/|--[\s\xA0]|'.
           '0x[0-9a-f]+|0b[01]+|x\'[0-9a-f]+\'|b\'[01]+\'|'.
           '[\s\xA0\'"]+(as|or|and|r*like|regexp)[\s\xA0\'"]+|'.
           'union[\s\xA0]+select|[\s\xA0](where|having)|'.
           '[\s\xA0](group|order)[\s\xA0]+by|limit[\s\xA0]+\d|'.
           'information_schema|procedure\s+analyse\s*/is',
           $id.','.$pw
       ) and die('Hack detected');

class Logger{
     private $logFile;
     private $initMsg;
     private $exitMsg;

     function __construct($file){
         // initialise variables
         $this->initMsg="#--session started--#\n";
         $this->exitMsg="#--session end--#\n";
         $this->logFile = "/tmp/natas26_" . $file . ".log";

         // write initial message
         $fd=fopen($this->logFile,"a+");
         fwrite($fd,$initMsg);
         fclose($fd);
     }

     function log($msg){
         $fd=fopen($this->logFile,"a+");
         fwrite($fd,$msg."\n");
         fclose($fd);
     }

     function __destruct(){
         // write exit message
         $fd=fopen($this->logFile,"a+");
         fwrite($fd,$this->exitMsg);
         fclose($fd);
     }
 }