Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack

From: Date: Tue, 28 Jul 2015 20:42:41 +0000
Subject: Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack
References: 1 2  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message 
Rowan Collins wrote:

> On 28 July 2015 18:33:31 BST, Matt Tait <[email protected]> wrote:
>> Hi all,
>>
>> I've written an RFC (and PoC) about automatic detection and blocking of
>> SQL
>> injection vulnerabilities directly from inside PHP via automated taint
>> analysis.
>>
>> https://wiki.php.net/rfc/sql_injection_protection
>  
> Have you searched the list archive and wiki for previous discussions and prototypes of variable
> tainting? The idea may well have some legs, but there might be some interesting points from previous
> discussions to note in your RFC.

FWIW, there is the inactive "Taint support for PHP"[1] RFC.

[1] <https://wiki.php.net/rfc/taint>

-- 
Christoph M. Becker

Thread (45 messages)

« previous php.internals (#87350) next »