简介

Taint is an extension, which is used for detecting XSS codes(tainted string). And also can be used to spot sql injection vulnerabilities, and shell inject, etc.

When taint is enabled, if you pass a tainted string (comes from $_GET, $_POST or $_COOKIE) to some functions, taint will warn you about that.

Example #1 Taint()example

 <?php
$a = trim($_GET['a']);

$file_name = '/tmp' .  $a;
$output    = "Welcome, {$a} !!!";
$var       = "output";
$sql       = "Select *  from " . $a;
$sql      .= "ooxx";

echo $output;

print $$var;

include($file_name);

mysql_query($sql);
?>

以上例程的输出类似于：

Warning: main() [function.echo]: Attempt to echo a string that might be tainted

Warning: main() [function.echo]: Attempt to print a string that might be tainted

Warning: include() [function.include]: File path contains data that might be tainted

Warning: mysql_query() [function.mysql-query]: SQL statement contains data that might be tainted

php 其它基本扩展 taint php sequence updates all values by applying a callback function to each value php sequence reverses the sequence in place php set returns a shallow copy of the set php taint 函数 checks whether a string is tainted php pspell 函数 add the word to the wordlist in the current session php pspell 函数 store a replacement pair for a word php paradox 函数 returns number of fields in a database php taint 函数 taint a string php taint 函数 untaint strings php taint 简介 php mongodb driver monitoring commandsucceededevent returns the command name php mongodb driver exception runtimeexception returns whether an error label is associated with an exception php mongodb driver server checks if this server is a passive member of a replica set php taint taint 函数 php taint more details php taint 安装／配置 php 用户空间命名指南全局命名空间 php v8jsexception the getjslinenumber purpose php 安装／配置需求