\u5f53\u5e94\u7528\u5728\u8c03\u7528\u4e00\u4e9b\u5b57\u7b26\u4e32\u8f6c\u5316\u4e3a\u4ee3\u7801\u7684\u51fd\u6570\u65f6\uff0c\u6ca1\u6709\u8003\u8651\u7528\u6237\u662f\u5426\u80fd\u63a7\u5236\u8fd9\u4e2a\u5b57\u7b26\u4e32\uff0c\u5c06\u9020\u6210\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e(\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e)<\/p>\n
PHP eval()\u3001assert()\u3001preg_replace()<\/p>\n
python eval<\/p>\n
Java \u6ca1\u6709\u7c7b\u4f3c\u4e8e\u524d\u9762\u4e24\u8005\u7684\u51fd\u6570\uff0c\u4f46\u662f\u6709\u53cd\u5c04\u673a\u5236\uff0c\u5e76\u4e14\u6709\u57fa\u4e8e\u53cd\u5c04\u673a\u5236\u7684\u8868\u8fbe\u5f0f\u5f15\u64ce\uff0c\u5982\uff1a0GNL\u3001SpEL\u3001MVEL \u7b49<\/p>\n
\u52a8\u6001\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u5728\u7a0b\u5e8f\u5f00\u53d1\u8fc7\u7a0b\u4e2d\uff0c\u9700\u8981\u7528\u52a8\u6001\u8c03\u7528\u51fd\u6570\uff0c\u5982\u679c\u53c2\u6570\u53ef\u63a7\u7684\u60c5\u51b5\u4e0b\uff0c\u4f1a\u9020\u6210\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002<\/p>\n
<?php\nfunction m_print(){\necho '\u8fd9\u662f\u4e00\u4e2a\u9875\u9762';\n}\n$_GET['a']($_GET['b']);\n?><\/code><\/pre>\n\u67e5\u770b php \u4fe1\u606f assert \u53ef\u4ee5\u6267\u884c php \u91cc\u9762\u7684\u4e00\u4e9b\u51fd\u6570\u6bd4\u5982 phpinfo()<\/p>\n
eval\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e<\/h2>\n<?php\n$data = isset($_GET['data'])?$_GET['data']:'\u8fd9\u662f\u4e00\u4e2a eval \u6f0f\u6d1e\u9875\u9762';\n@eval($ret = $data);\necho $ret;\n?><\/code><\/pre>\neval \u2014 \u628a\u5b57\u7b26\u4e32\u4f5c\u4e3a PHP \u4ee3\u7801\u6267\u884c<\/p>\n
\u6b63\u5219\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e<\/h2>\n
preg_replace \u4f7f\u7528\u4e86 \/e \u6a21\u5f0f\uff0c\u5bfc\u81f4\u53ef\u4ee5\u4ee3\u7801\u6267\u884c<\/p>\n
<?php\n$data = $_GET['data'];\npreg_replace('\/<data>(.*)<\/data>\/e','$ret = \"\\1\";',$data);\n?>\n<form>\n<label>\u8bf7\u8f93\u5165\u4f60\u7684\u6570\u636e<\/label>\n<input type='text' name='data'\/>\n<input type='submit' value='\u63d0\u4ea4'\/>\n<\/form>\n<data>{${phpinfo()}}<\/data><\/code><\/pre>\n\u4ee3\u7801\u6267\u884c\u7684\u653b\u51fb\u65b9\u6cd5<\/h2>\n
\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u662f\u4e00\u79cd\u5f88\u4e25\u91cd\u7684\u6f0f\u6d1e\uff0c\u56e0\u4e3a\u80fd\u6ce8\u5165\u6267\u884c\u811a\u672c\u4ee3\u7801\uff0c\u6240\u4ee5\u5229\u7528\u7684\u624b\u6bb5\u5f88\u591a\uff0c\u5e38\u89c1\u7684\u6267\u884c\u547d\u4ee4\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\uff0c\u5199\u5165 web \u540e\u95e8\u7b49<\/p>\n
phpinfo();<\/p>\n
fputs(fopen("shell.php","a"),"<?php phpinfo();?>");<\/p>\n
\u4ee3\u7801\u6267\u884c\u7684\u9632\u5fa1\u65b9\u6cd5<\/h2>\n
1\u3001\u4f7f\u7528 json \u4fdd\u5b58\u6570\u7ec4\uff0c\u5f53\u8bfb\u53d6\u65f6\u5c31\u4e0d\u9700\u8981\u4f7f\u7528 eval \u4e86<\/p>\n
2\u3001\u5bf9\u4e8e\u5fc5\u987b\u4f7f\u7528 eval \u7684\u5730\u65b9\uff0c\u4e00\u5b9a\u4e25\u683c\u5904\u7406\u7528\u6237\u6570\u636e\uff08\u767d\u540d\u5355\u3001\u9ed1\u540d\u5355\uff09<\/p>\n
3\u3001\u5b57\u7b26\u4e32\u4f7f\u7528\u5355\u5f15\u53f7\u5305\u62ec\u53ef\u63a7\u4ee3\u7801\uff0c\u63d2\u5165\u524d\u4f7f\u7528 addslashes \u8f6c\u4e49\uff08addslashes\u3001\u9b54\u6570\u5f15\u53f7\u3001htmlspecialchars\u3001 htmlentities\u3001mysql_real_escape_string\uff09<\/p>\n
4\u3001\u653e\u5f03\u4f7f\u7528 preg_replace \u7684 e \u4fee\u9970\u7b26\uff0c\u4f7f\u7528 preg_replace_callback()\u66ff\u6362\uff08preg_replace_callback()\uff09<\/p>\n
5\u3001\u82e5\u5fc5\u987b\u4f7f\u7528 preg_replace \u7684 e \u4fee\u9970\u7b26\uff0c\u5219\u5fc5\u7528\u5355\u5f15\u53f7\u5305\u88f9\u6b63\u5219\u5339\u914d\u51fa\u7684\u5bf9\u8c61\uff08preg_replace+\u6b63\u5219\uff09<\/p>\n
\n