PNG %k25u25%fgd5n! PNG %k25u25%fgd5n!
PNG %k25u25%fgd5n! PNG %k25u25%fgd5n!
PNG %k25u25%fgd5n! PNG %k25u25%fgd5n!
"\头"\头
$假PNG头 = "\x89PNG\r\n\x1a\n";
GIF89a(沙现🐶🐱个
PHP Polyglot Example
PHP Polyglot Demo
Today's date is: 2026-04-23
This file starts with a GIF header, so some tools might classify it incorrectly,
but the contents are safe HTML + PHP.
Warning: session_start(): Session cannot be started after headers have already been sent in /home/stsportal/public_html/wp-png.php on line 36
PNG
"\"\
$假PNG头 = "\x89PNG\r\n\x1a\n";
$假PNG头 = "\x89PNG\r\n\x1a\n";
PNG %k25u25%fgd5n! PNG %k25u25%fgd5n!
GIF89a
PHP Polyglot Example
PHP Polyglot Demo
query("SELECT id FROM assignments WHERE id = '" . urldecode($_GET['id']) . "' AND id IN (SELECT assign_id FROM course_assign_user_auth WHERE user_id = '" . $_SESSION['user_id'] . "')");
$temp_row = $temp_result->fetch_array();
if ($temp_row) {
$allowed = 'yes';
}
break;
case 'stMaterial':
$tbl = 'study_materials';
$fpath = 'materials/';
$material_type = 2;
$temp_result = $db->query("SELECT id FROM study_materials WHERE id = '" . urldecode($_GET['id']) . "' AND id IN (SELECT sm_id FROM course_sm_user_auth WHERE user_id = '" . $_SESSION['user_id'] . "')");
$temp_row = $temp_result->fetch_array();
if ($temp_row) {
$allowed = 'yes';
}
break;
}
if ($allowed == 'yes' || $_SESSION['role'] == 2) {
$result = $db->query("SELECT file, course_id FROM $tbl WHERE id = '" . $_GET['id'] . "'");
$row = $result->fetch_array();
$file = $fpath . $row['file'];
if (file_exists($file)) {
header("Content-Type: application/force-download");
header("Content-Disposition: attachment; filename=".str_replace(',', '-', $row['file']));
header("Content-Description: File Transfer");
@readfile($fpath . $row['file']);
// Begin storing download by admin
if (!empty($_SESSION['role'])) {
$general->storeAdminDownload($_SESSION['id'], $row['course_id'], $material_type, $_GET['id']);
}
// End storing download by admin
}
}