简介

Taint is an extension, which is used for detecting XSS codes(tainted string). And also can be used to spot sql injection vulnerabilities, and shell inject, etc.

When taint is enabled, if you pass a tainted string (comes from $_GET, $_POST or $_COOKIE) to some functions, taint will warn you about that.

Example #1 Taint()example

 <?php
$a = trim($_GET['a']);

$file_name = '/tmp' .  $a;
$output    = "Welcome, {$a} !!!";
$var       = "output";
$sql       = "Select *  from " . $a;
$sql      .= "ooxx";

echo $output;

print $$var;

include($file_name);

mysql_query($sql);
?>

以上例程的输出类似于：

Warning: main() [function.echo]: Attempt to echo a string that might be tainted

Warning: main() [function.echo]: Attempt to print a string that might be tainted

Warning: include() [function.include]: File path contains data that might be tainted

Warning: mysql_query() [function.mysql-query]: SQL statement contains data that might be tainted

php 其它基本扩展 taint php cairofontoptions the setsubpixelorder purpose php cairoimagesurface retrieves the width of the cairoimagesurface php cairopattern the getmatrix purpose php taint 函数 checks whether a string is tainted php maxdb 函数 returns whether thread safety is given or not php 多字节字符串函数 regular expression match for multibyte string php 多字节字符串函数设置/获取内部字符编码 php taint 函数 taint a string php taint 函数 untaint strings php opcode descriptions and examples isset isempty var php opcode descriptions and examples post inc php opcode descriptions and examples sl php taint 简介 php taint taint 函数 php solrquery determines what kind of parameters to include in the response php solrquery specifies a string prefix with which to limits the terms on which to facet php solrquery use spanscorer to highlight phrase terms php taint more details php taint 安装／配置