How can I bypass password verification?

Question

PHP

There is such a code with a loophole (sort of) to get the value of the password field from the form:

<?php
require 'flag.php';

if (isset ($_GET['password'])) {
  if (ereg ("^[a-zA-Z0-9]+$", $_GET['password']) === FALSE)
    echo '<p class="alert">You password must be alphanumeric</p>';
  else if (strpos ($_GET['password'], '--') !== FALSE)
    die('Flag: ' . $flag);
  else
    echo '<p class="alert">Wrong passsword</p>';
}
?>

Is there a way to somehow "trick" the input character filtering and get the value of the $flag variable?

Answer 1

$_GET['password'] = [''];

Answer 2

Exploit null byte vulnerability
Add %00 to the end of the string. Everything after these characters will not be read regularly, but it will be possible to insert the necessary characters that match the condition for obtaining the flag
Solution task example.com/?password=pass%00--

Answer 3

No.