<?php
header("content-type: text/javascript");

$msg = <<<EOM
Happy Birthday Joelllllll!

Here are 24 candles:
i i i i i i i i i i i i i i i i i i i i i i i i

If you view the source for this page . . . . go ahead, do it.

See? Not much there, despite all of the action going on above.  You
probably noticed the script tag in the head of the page.  If you were to
download this script you still wouldn't really know whats going on because
all it does it setup a background request back to the same script url with
an extra argument and add a callback to evaluate whatever code the script
contains.  Now, if you fetched that one, you'd still probably not see even
a single character of this message here.  That script contains just enough
code to add another hex string to the line at the top and setup yet another
background request back to the script with a different argument.  Now, if
you repeat this process enough (like your browser it doing right now),
eventually youll start to see some of the code fetched is a little bit
different.  It has a little more code that adds one more character to the
message box thats filling up here.  The process goes on and on and on and
your browser is probably getting sick of playing this game by now.

I haven't told you how the whole system knows to feed you the characters of
the message in order even if you refresh the page and start from the beginning
(the extra argument 'key' is not involved at all, by the way).... I'll leave
that as an excercise to the reader, if he's up to it.... (hint: wireshark it)

Don't give away the secret, though, I need to save this card for other people.
EOM;

$key = $_GET['key'];
$stage = $_COOKIE['X-Decode-Stage'];

if($key != null) {

	if(!rand(0,1)) {
	setcookie("X-Decode-Stage", $stage+1);
	$char = ($stage<strlen($msg))?$msg[$stage]:"";
	$char = ($char=="\n")?"<br/>":$char;
?>
box.innerHTML = "hit!";
msg.innerHTML += "<?php print $char ?>";
ticker--;
<?php
	}
?>
var req = new XMLHttpRequest();
req.onload = function(){eval(req.responseText)};
req.open("GET", "puzzle.php?key=<?php print md5(rand()); ?>", true);
req.send(null);
box.innerHTML = "<?php print md5($key) ?>";
tickerspan.innerHTML = (ticker++)+" pointless web requests executed";
<?php
} else {
	setcookie("X-Decode-Stage", 0);
?>
window.onload=function(){
	var box = document.createElement("span");
	box.style.color = 'white';
	box.style.background = 'black';
	document.body.appendChild(box);
	document.body.appendChild(document.createElement("br"));
	document.body.appendChild(document.createElement("br"));
	var tickerspan = document.createElement("span");
	var ticker = 0;
	document.body.appendChild(tickerspan);
	document.body.appendChild(document.createElement("br"));
	var msg = document.createElement("blockquote");
	msg.style.color="gray";
	document.body.appendChild(msg);
	var req = new XMLHttpRequest();
	req.onload = function(){eval(req.responseText)};
	req.open("GET", "puzzle.php?key=<?php print md5(rand()); ?>", true);
	req.send(null);
}
<?php
}
?>
