PHP FILTER_UNSAFE_RAW过滤器失效漏洞

- 显示filter.default和filter.default_flags值 - 检查$_GET['a']是否包含有空字节（FILTER_UNSAFE_RAW应通过FILTER_FLAG_STRIP_LOW标记过滤掉空字节） - 通过带有相同过滤器/标记的filter_input()检查$_GET['a']是否包含有空字节 <?php echo "filter.default = " . ini_get('filter.default') . " <br />\n"; echo "filter.default_flags = " . ini_get('filter.default_flags') . " <br />\n"; echo "<br />"; echo "\$_GET['a'] contains \\0: " . (strpos($_GET['a'], "\0") !== false ? 'Yes' : 'No') . " <br />\n"; echo "<br />"; echo "\$_GET['a'] throught filter_var() contains \\0: " . (strpos(filter_var($_GET['a'], FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW), "\0") !== false ? 'Yes' : 'No') . "<br />"; echo "<br />"; ?> 预期结果 ---------------- filter.default: unsafe_raw filter.default_flags: 4 $_GET['a'] contains \0: No $_GET['a'] through filter_var() contains \0: No 实际结果 -------------- filter.default: unsafe_raw filter.default_flags: 4 $_GET['a'] contains \0: Yes $_GET['a'] through filter_var() contains \0: No