Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack
| From: | Christoph Becker | Date: | Tue, 28 Jul 2015 20:42:41 +0000 |
| Subject: | Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-87350@lists.php.net to get a copy of this message | ||
Rowan Collins wrote:
> On 28 July 2015 18:33:31 BST, Matt Tait <matt.tait@gmail.com> wrote:
>> Hi all,
>>
>> I've written an RFC (and PoC) about automatic detection and blocking of
>> SQL
>> injection vulnerabilities directly from inside PHP via automated taint
>> analysis.
>>
>> https://wiki.php.net/rfc/sql_injection_protection
>
> Have you searched the list archive and wiki for previous discussions and prototypes of variable
> tainting? The idea may well have some legs, but there might be some interesting points from previous
> discussions to note in your RFC.
FWIW, there is the inactive "Taint support for PHP"[1] RFC.
[1] <https://wiki.php.net/rfc/taint>
--
Christoph M. Becker