Home/ Questions/Q 6165041
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T22:05:48+00:00

I’d like to write a static code analysis tool for finding SQLi vulnerabilities in

  • 0

I’d like to write a static code analysis tool for finding SQLi vulnerabilities in PHP code. Usually, I just use a script to separate functions, and grep them for inadequate sanitisation. Obviously this approach is limited.

The outline of the program I want to write is:

  1. Find all calls to mysql_query
  2. Find all references to the functions that call mysql_query
  3. Track all variables that go into each query call, and find out if mysql_real_escape_string is run on them.

I’m caught between two approaches to writing this. Either I go for a PHP extension, or write it as a standalone from scratch.

The advantages of using a PHP extension is that I wouldn’t have to make my own tokenizer, parser etc (I presume, basing this on the capabilities of the XDebug extension).

Does anyone with experience in writing PHP extensions have any advice on how to approach the problem?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I suggest looking at the RIPS Scanner project and review its source code for ideas. It performs exactly the functions you wish to do.

    • 0