Rating:

### Solution:
> A calculator web app using PHP to run (it can be seen if you open Inspector and check the input box form action.).  
>
> ![](https://media.discordapp.net/attachments/771504940623331378/773725370465648640/unknown.png)  
>
> Our hint tells us a lot. The best way to evaluate user input (in my opinion) is just to print/return whatever your just typed in (you can test this out with some strings of text like "a", but this is a calculator, so it will try to evaluate it like an expression). Since we are using PHP, and our description mentions a flag variable, we can research the symbol to call for a variable. The calculator will just output it to us.  
>
> ![](https://media.discordapp.net/attachments/771504940623331378/773724141009371146/unknown.png
>
> "$flag" should do the trick.  
>
> ![](https://media.discordapp.net/attachments/771504940623331378/773724276951482378/unknown.png)  

#### **Flag:** nactf{ev1l_eval}