Question

I have to make a script in PHP that will scan other PHP files to check for dangerous function calls like eval,exec .
Is there any parser available that can give me a logical structure of code.

Or i have to go with Regex.

Thanks, any type suggestions are welcome.

Arshdeep

Edit: i am not considering it as “one shot kill all”. I have some other things in mind too, but its still something that i have to do.

Answer 1

You can use tokenizer to do that:

print_r(token_get_all('<?php exec("rm -rf *"); ?>'));

Notice in the output the third element which is:

[1] => Array
    (
        [0] => 307
        [1] => exec
        [2] => 1
    )