PHP静态安全扫描器：php-security-scanner
jopen
9年前
它能够探测传递的不安全变量到不安全的函数参数。
用法:
bin/php-security-scanner scan path/to/files
它将搜索所有文件的安全问题。
示例
Given the following code:
<?php function bar() { foo($_GET['name']); } function foo($name) { mysql_query("SELECT * FROM foo WHERE name = '$name'"); } ?>Running the scanner on this file will identify like 4 as an error, with the message:
Possible SQL Injection found in call to foo() argument number 1
Supported vulnerability scanners:
Currently, onlymysql_queryis supported, and only in limited situations.