Dest0g3 520迎新赛-web-EasyPHP

<?php
highlight_file(__FILE__);
include "fl4g.php";
$dest0g3 = $_POST['ctf'];
$time = date("H");
$timme = date("d");
$timmme = date("i");
if(($time > "24") or ($timme > "31") or ($timmme > "60")){
    echo $fl4g;
}else{
    echo "Try harder!";
}
set_error_handler(
    function() use(&$fl4g) {
        print $fl4g;
    }
);
$fl4g .= $dest0g3;
?> Try harder!

关键在于set_error_handler函数
通过 set_error_handler() 函数设置用户自定义的错误处理程序，然后触发错误。这里触发错误后会输出flag

注意到$fl4g .= $dest0g3;是一个字符拼接的操作，数组和字符拼接会出错，所以构造ctf[]=1即可