class Challenge {
  const UPLOAD_DIRECTORY = './solutions/';
  private $file;
  private $whitelist;

  public function __construct($file) {
    $this->file = $file;
    $this->whitelist = range(1, 24);
  }

  public function __destruct() {
    if (in_array($this->file['name'], $this->whitelist)) {
      move_uploaded_file(
        $this->file['tmp_name'],
        self::UPLOAD_DIRECTORY . $this->file['name']
      );
    }
  }
}

$challenge = new Challenge($_FILES['solution']);

 1 // composer require "twig/twig"
 2 require 'vendor/autoload.php';
 3 
 4 class Template {
 5   private $twig;
 6 
 7   public function __construct() {
 8     $indexTemplate = '<img ' .
 9       'src="https://loremflickr.com/320/240">' .
10       '<a href="{{link|escape}}">Next slide &raquo;</a>';
11 
12     // Default twig setup, simulate loading
13     // index.html file from disk
14     $loader = new Twig\Loader\ArrayLoader([
15       'index.html' => $indexTemplate
16     ]);
17     $this->twig = new Twig\Environment($loader);
18   }
19 
20   public function getNexSlideUrl() {
21     $nextSlide = $_GET['nextSlide'];
22     return filter_var($nextSlide, FILTER_VALIDATE_URL);
23   }
24 
25   public function render() {
26     echo $this->twig->render(
27       'index.html',
28       ['link' => $this->getNexSlideUrl()]
29     );
30   }
31 }
32 
33 (new Template())->render();

<?php
    $url = filter_var($_GET['url'],FILTER_VALIDATE_URL);  
    $url = htmlspecialchars($url);
    echo "<a href='$url'>Next slide</a>";
?>

 1 function __autoload($className) {
 2   include $className;
 3 }
 4 
 5 $controllerName = $_GET['c'];
 6 $data = $_GET['d'];
 7 
 8 if (class_exists($controllerName)) {
 9   $controller = new $controllerName($data['t'], $data['v']);
10   $controller->render();
11 } else {
12   echo 'There is no page with this name';
13 }
14 
15 class HomeController {
16   private $template;
17   private $variables;
18 
19   public function __construct($template, $variables) {
20     $this->template = $template;
21     $this->variables = $variables;
22   }
23 
24   public function render() {
25     if ($this->variables['new']) {
26       echo 'controller rendering new response';
27     } else {
28       echo 'controller rendering old response';
29     }
30   }
31 }

libxml_disable_entity_loader(true);

 1 class Login {
 2   public function __construct($user, $pass) {
 3     $this->loginViaXml($user, $pass);
 4   }
 5 
 6   public function loginViaXml($user, $pass) {
 7     if (
 8       (!strpos($user, '<') || !strpos($user, '>')) &&
 9       (!strpos($pass, '<') || !strpos($pass, '>'))
10     ) {
11       $format = '<?xml version="1.0"?>' .
12         '<user v="%s"/><pass v="%s"/>';
13       $xml = sprintf($format, $user, $pass);
14       $xmlElement = new SimpleXMLElement($xml);
15       // Perform the actual login.
16       $this->login($xmlElement);
17     }
18   }
19 }
20 
21 new Login($_POST['username'], $_POST['password']);

user=<"><injected-tag%20property="&pass=<injected-tag>

<?php
$user = '<"><injected-tag property=" ';
$pass = '<injected-tag>';
var_dump(strpos($user, '<'));    //int 0
var_dump(!strpos($user, '<'));   //boolean true
var_dump(strpos($user, '>'));    //int 2
var_dump(!strpos($user, '<'));   //boolean false

var_dump(
    (!strpos($user, '<')) || !strpos($user, '>')) && (!strpos($user, '<')) || !strpos($user, '>'))
)    //boolean true
     //相当于var_dump((true || false) && (true || false))
?>