4 ms·
I just did the same :) It flags, for example, the following as an SQL injection: query("DELETE FROM foo WHERE id=1");$id=2; In other words, it's flagging
by oneeyedpigeon 10y ago
I just did the same :) It flags, for example, the following as an SQL injection:
query("DELETE FROM foo WHERE id=1");$id=2;
In other words, it's flagging any line that begins with "DELETE ... FROM" and then later has a variable. Now, that might be a fairly strong correlation, but it's definitely far from perfect.
- tyingq 10y agoI suspect you can fool it by splitting into different lines, which is actually common with longish queries. $query="SELECT whatever from foo WHERE". "id=$bar ". "AND " . "field=$value";
- laurent123456 10y agoYes there are false positives. It would be too time consuming to extract and parse the PHP code from the questions since there are millions of them to process, however I found that the regexes, though not perfect, provide a good estimate and are quick to execute.
- tyingq 10y agoYou could tweak the regexes a bit to fix some things... - it's currently skipping variable names with underscores, and it's matching variable names that start with numbers, which isn't a valid variable name - the false positives coming from ->execute($whatever) could be fixed by not searching after a > character. I don't think that would create any notable amount of false negatives. Like, for example, changing: '/UPDATE\s+.*?\sSET\s.*?\$[a-zA-Z0-9].*?/i' To '/UPDATE\s+.*?\sSET\s[^>]*?\$[a-zA-Z_]/i'