参考https://www.cnblogs.com/NPFS/p/13338789.html
源码：
<?phpfunction text($str){ return str_replace('x', '66', $str);}$name = $_GET['name'];$sigh = 'hello everyone';$user = array($name, $sigh);
$r = text(serialize($user));echo $r;echo "<br>";$fake = unserialize($r);echo $fake[0];echo "<br>";echo $fake[1];echo "<br>";var_dump($fake);?>
<!-- <?php error_reporting(0); class a { public $uname; public $password; public function __construct($uname, $password) { $this->uname = $uname; $this->password = $password; } public function __wakeup() { if ($this->password === 'yu22x') { // include('flag.php'); echo "flag"; } else { echo 'wrong password'; } } } function filter($string) { return str_replace('Firebasky', 'Firebaskyup', $string); } $uname = $_GET['uname']; $password = 1; $ser = filter(serialize(new a($uname, $password))); $test = unserialize($ser); echo "<br>"; echo $ser; echo "<br>"; echo $test->uname, "<br>", $test->password; echo "<br>"; var_dump($test) ?> -->