PHP source review
When it applies
Reviewing PHP source (a repo, a PR, or a leaked webroot). PHP's defaults and dynamic features make
several classes easy to introduce, so a grep-then-trace pass finds most of them fast.
Why it works
Many PHP sinks execute or include whatever string they're given, and loose typing turns comparison
and casting into logic bugs. Tracing each sink back to a request source ($_GET/$_POST/$_REQUEST/ $_COOKIE/$_SERVER, php://input) tells you which are actually reachable.
Sinks & patterns (grep, then trace to user input)
- Code exec:
eval, assert, preg_replace with /e, create_function, call_user_func(_array).
- Command exec:
system, exec, shell_exec, passthru, proc_open, popen, backticks.
- File include (LFI/RFI):
include/require(_once) with a variable; allow_url_include.
- SQLi: string-interpolated queries into
mysqli_query/PDO::query (vs prepared statements).
- Deserialization:
unserialize() on input (POP chains); phar:// via file functions.
- File / path:
file_get_contents, fopen, readfile, move_uploaded_file with user paths.
- Other:
extract() on input (variable overwrite), parse_str, SSRF via curl/file_get_contents.
Framework specifics
- Laravel:
DB::raw/whereRaw, Blade {!! !!} (unescaped), mass assignment ($guarded=[]),
unserialize in queues, Storage path traversal.
- Symfony: unsafe deserialization, Twig
|raw, expression-language injection.
- WordPress: unsanitised
$wpdb->query, missing nonce/cap checks, unsafe add_query_arg,
unauthenticated AJAX/REST callbacks.
Method
rg the sinks above; for each, trace the argument back to a request source.- Note type-juggling auth checks (
== vs ===, strcmp returning 0/null) and loose casts.
- Check upload handlers (extension/content-type allowlist, exec in upload dir).
- Confirm exploitability with the matching runtime skill (
web-command-injection,
web-deserialization, web-lfi-path-traversal, web-sqli).
Gotchas
- A sink is only a bug if input reaches it — don't report unreachable
eval.
- WordPress plugins: unauthenticated
wp_ajax_nopriv_* and REST endpoints are the high-value paths.
== type juggling ("0e123"=="0e456") still breaks weak hash/token comparisons.
References
OWASP PHP security; RIPS/progpilot sink catalogue; PHP unserialize POP-chain research (PHentication).
1---2name: code-review-php3description: Security review of PHP code — dangerous sinks and framework pitfalls (Laravel/Symfony/WordPress). Load when reviewing a PHP codebase/PR, on .php source in scope, or "review this PHP". Signals: composer.json, index.php, Laravel/Symfony/WP, unserialize, include/require with variables, mysqli/PDO.4---56# PHP source review78## When it applies9Reviewing PHP source (a repo, a PR, or a leaked webroot). PHP's defaults and dynamic features make10several classes easy to introduce, so a grep-then-trace pass finds most of them fast.1112## Why it works13Many PHP sinks execute or include whatever string they're given, and loose typing turns comparison14and casting into logic bugs. Tracing each sink back to a request source (`$_GET/$_POST/$_REQUEST/15$_COOKIE/$_SERVER`, `php://input`) tells you which are actually reachable.1617## Sinks & patterns (grep, then trace to user input)18- **Code exec**: `eval`, `assert`, `preg_replace` with `/e`, `create_function`, `call_user_func(_array)`.19- **Command exec**: `system`, `exec`, `shell_exec`, `passthru`, `proc_open`, `popen`, backticks.20- **File include (LFI/RFI)**: `include`/`require`(`_once`) with a variable; `allow_url_include`.21- **SQLi**: string-interpolated queries into `mysqli_query`/`PDO::query` (vs prepared statements).22- **Deserialization**: `unserialize()` on input (POP chains); `phar://` via file functions.23- **File / path**: `file_get_contents`, `fopen`, `readfile`, `move_uploaded_file` with user paths.24- **Other**: `extract()` on input (variable overwrite), `parse_str`, SSRF via `curl`/`file_get_contents`.2526## Framework specifics27- **Laravel**: `DB::raw`/`whereRaw`, Blade `{!! !!}` (unescaped), mass assignment (`$guarded=[]`),28 `unserialize` in queues, `Storage` path traversal.29- **Symfony**: unsafe deserialization, Twig `|raw`, expression-language injection.30- **WordPress**: unsanitised `$wpdb->query`, missing nonce/cap checks, unsafe `add_query_arg`,31 unauthenticated AJAX/REST callbacks.3233## Method341. `rg` the sinks above; for each, trace the argument back to a request source.352. Note type-juggling auth checks (`==` vs `===`, `strcmp` returning `0`/null) and loose casts.363. Check upload handlers (extension/content-type allowlist, exec in upload dir).374. Confirm exploitability with the matching runtime skill (`web-command-injection`,38 `web-deserialization`, `web-lfi-path-traversal`, `web-sqli`).3940## Gotchas41- A sink is only a bug if input reaches it — don't report unreachable `eval`.42- WordPress plugins: unauthenticated `wp_ajax_nopriv_*` and REST endpoints are the high-value paths.43- `==` type juggling (`"0e123"=="0e456"`) still breaks weak hash/token comparisons.4445## References46OWASP PHP security; RIPS/progpilot sink catalogue; PHP `unserialize` POP-chain research (PHentication).
NoorQureshi