$_GET['cat'],$_GET['dog'] Under what circumstances does $v3 equal 1?

<code>$v3 = 0;

$c=@$_GET['cat'];
$d=@$_GET['dog'];
if(@$c[1]){
    
    if(!strcmp($c[1],$d) && $c[1]!==$d){
        echo $d.$c[0];
        eregi("3|1|c",$d.$c[0])?die("nope"):NULL;
        strpos(($c[0].$d), "htctf2016")?$v3=1:NULL;
    }
}

</code>

$_GET['cat'],$_GET['dog'] Under what circumstances does $v3 equal 1?

Reply content:

<code>$v3 = 0;

$c=@$_GET['cat'];
$d=@$_GET['dog'];
if(@$c[1]){
    
    if(!strcmp($c[1],$d) && $c[1]!==$d){
        echo $d.$c[0];
        eregi("3|1|c",$d.$c[0])?die("nope"):NULL;
        strpos(($c[0].$d), "htctf2016")?$v3=1:NULL;
    }
}

</code>

$_GET['cat'],$_GET['dog'] Under what circumstances does $v3 equal 1?

This problem is caused by PHP's weak typing. The technique used here is that when strcmp compares array and string, a null will be returned, and %00 can truncate eregi.