Solution:

A calculator web app using PHP to run (it can be seen if you open Inspector and check the input box form action.).  

 

Our hint tells us a lot. The best way to evaluate user input (in my opinion) is just to print/return whatever your just typed in (you can test this out with some strings of text like "a", but this is a calculator, so it will try to evaluate it like an expression). Since we are using PHP, and our description mentions a flag variable, we can research the symbol to call for a variable. The calculator will just output it to us.  

 

"$flag" should do the trick.  

 

Flag: nactf{ev1l_eval}