4 ms·
Yes there are false positives. It would be too time consuming to extract and parse the PHP code from the questions since there are millions of them to process,
by laurent123456 10y ago
Yes there are false positives. It would be too time consuming to extract and parse the PHP code from the questions since there are millions of them to process, however I found that the regexes, though not perfect, provide a good estimate and are quick to execute.
- tyingq 10y agoYou could tweak the regexes a bit to fix some things... - it's currently skipping variable names with underscores, and it's matching variable names that start with numbers, which isn't a valid variable name - the false positives coming from ->execute($whatever) could be fixed by not searching after a > character. I don't think that would create any notable amount of false negatives. Like, for example, changing: '/UPDATE\s+.*?\sSET\s.*?\$[a-zA-Z0-9].*?/i' To '/UPDATE\s+.*?\sSET\s[^>]*?\$[a-zA-Z_]/i'