Under [x] ray

<?php
    // It would be too easy if I give you flag and password, isn't it?
    $flag = ""; // Not the flag
    $real_password = ""; // Not the password in production

    if (!empty($_GET['password'])){
        $password = $_GET['password'];

        if (strcmp($password, $real_password) == 0) {
            echo "How dare you??? Here's the flag: ".$flag;
            exit(0);
        } else  {
            echo "Wrong. Bad flag!<br>";
        }
    }

    echo "Give me a password! I can even give you the source code (without flag and password): <a href='www.google.com' >check here</a>";
?>