<?php
error_reporting(0);
define('FLAG','CTF{THIS_IS_FLAG}');
$l01o=0;
$o1l0=0;
$o10l=0;
$lo10=0;
if (isset($_GET['vhghf'])) //GET传入一个vhghf
{
        $vhghf = $_GET['vhghf'];
        $vhghf=="1"?die("ha?"):NULL; //如果vhghf等于1则退出
        switch ($vhghf)
        {
        case 0:
        case 1: //如果vhghf等于1则$101o等于1
                $l01o=1;
                echo "1";
                break;
        }
}
$dfgdf=(array)json_decode(@$_GET['dfgdf']); //GET传入dfgdf且进行json_decode且创建一个数组
if(is_array($dfgdf)){  //如果为数组则进行接下来的
    is_numeric(@$dfgdf["gvnghdjk"])?die("ha?"):NULL; //判断dfgdf中的gvnghdjk是否为数字或数字字符串
    if(@$dfgdf["gvnghdjk"]){
        ($dfgdf["gvnghdjk"]>2017)?$o1l0=1:NULL; //gvnghdjk大于2017
         
    }
    var_dump($dfgdf["uxcndffznb"]);
    if(is_array(@$dfgdf["uxcndffznb"])){ //uxcndffznb要为数组
        echo "2";
        if(count($dfgdf["uxcndffznb"])!==2 OR !is_array($dfgdf["uxcndffznb"][0])) die("ha?"); //数组中有两个值，且第一个还要为数组
        $kghdhfghdfgbcvhgffg = array_search("ZCTF", $dfgdf["uxcndffznb"]); //查询uxcndffznb中有没有ZCTF有则返回1没则返回false
        var_dump($kghdhfghdfgbcvhgffg);
        $kghdhfghdfgbcvhgffg===false?die("ha?"):NULL; //如果为false则退出
        foreach($dfgdf["uxcndffznb"] as $key=>$val){ //查询uxcndffznb中是否有ZCTF如果有则退出
            var_dump($val);
			
            $val==="ZCTF"?die("ha?"):NULL;
			echo $val;
        }
        $o10l=1;
        echo "3"."<br>";
}
}
$cdggjydcnfsdyjaq = $_GET['cdggjydcnfsdyjaq']; //MD5碰撞
if ($cdggjydcnfsdyjaq != '15562') {
    if (strstr($cdggjydcnfsdyjaq, '2017ZCTF')) {
        if (substr(md5($cdggjydcnfsdyjaq),8,16) == substr(md5('15562'),8,16)) {
            echo "4"."<br>";
            $lo10=1;
        }
    }
}
if($l01o && $o1l0 && $o10l && $lo10){
    echo "success,flag:".FLAG;
}
?>

string
integer
array
double
object
resource
NULL
string array NULL  可以从RGPC传入
遇到不符类型，自动转换

'' == 0 == false
'123' == 123
'abc' == 0
'123a' == 123
'0x01' == 1
'0e123456789' == '0e987654321'
[false] == [0] == [NULL] == ['']
NULL == false == 0
true == 1

<?php
error_reporting(0);
function show_error_message($message)
{
    die("<div class=\"msg error\" id=\"message\">
    <i class=\"fa fa-exclamation-triangle\"></i>$message</div>");
}
function show_message($message)
{
    echo("<div class=\"msg success\" id=\"message\">
    <i class=\"fa fa-exclamation-triangle\"></i>$message</div>");
}
function random_str($length = "32")
{
    $set = array("a", "A", "b", "B", "c", "C", "d", "D", "e", "E", "f", "F",
        "g", "G", "h", "H", "i", "I", "j", "J", "k", "K", "l", "L",
        "m", "M", "n", "N", "o", "O", "p", "P", "q", "Q", "r", "R",
        "s", "S", "t", "T", "u", "U", "v", "V", "w", "W", "x", "X",
        "y", "Y", "z", "Z", "1", "2", "3", "4", "5", "6", "7", "8", "9");//61
    $str = '';
    for ($i = 1; $i <= $length; ++$i) {
        $ch = mt_rand(0, count($set) - 1);
        $str .= $set[$ch];
    }
    echo "$ch";
    return $str;
}
session_start();
$reg='/gif|jpg|jpeg|png/';
if (isset($_POST['submit'])) {
    $seed = rand(0,999999999);
    mt_srand($seed);
    $ss = mt_rand();
    $hash = md5(session_id() . $ss);
    setcookie('SESSI0N', $hash, time() + 3600);
    if ($_FILES["file"]["error"] > 0) {
        show_error_message("Upload ERROR. Return Code: " . $_FILES["file-upload-field"]["error"]);
    }
    $check1 = ((($_FILES["file-upload-field"]["type"] == "image/gif")
            || ($_FILES["file-upload-field"]["type"] == "image/jpeg")
            || ($_FILES["file-upload-field"]["type"] == "image/pjpeg")
            || ($_FILES["file-upload-field"]["type"] == "image/png"))
        && ($_FILES["file-upload-field"]["size"] < 204800));
    $check2=!preg_match($reg,pathinfo($_FILES['file-upload-field']['name'], PATHINFO_EXTENSION));
    if ($check2) show_error_message("Nope!");
    if ($check1) {
        $filename = './uP1O4Ds/' . random_str() . '_' . $_FILES['file-upload-field']['name'];
        if (move_uploaded_file($_FILES['file-upload-field']['tmp_name'], $filename)) {
            show_message("Upload successfully. File type:" . $_FILES["file-upload-field"]["type"]);
        } else show_error_message("Something wrong with the upload...");
    } else {
        show_error_message("only allow gif/jpeg/png files smaller than 200kb!");
    }
}
?>