# Taint

# 简介

Taint is an extension, which is used for detecting XSS codes (tainted string). And also can be used to spot sql injection vulnerabilities, and shell inject, etc.

When taint is enabled, if you pass a tainted string (comes from $_GET, $_POST or $_COOKIE) to some functions, taint will warn you about that.

示例 #1 Taint()example

    <?php
    $a = trim($_GET['a']);

    $file_name = '/tmp' .  $a;
    $output    = "Welcome, {$a} !!!";
    $var       = "output";
    $sql       = "Select *  from " . $a;
    $sql      .= "ooxx";

    echo $output;

    print $$var;

    include $file_name;

    mysql_query($sql);
    ?>

以上示例的输出类似于：

    Warning: main() [function.echo]: Attempt to echo a string that might be tainted

    Warning: main() [function.echo]: Attempt to print a string that might be tainted

    Warning: include() [function.include]: File path contains data that might be tainted

    Warning: mysql_query() [function.mysql-query]: SQL statement contains data that might be tainted

- 安装/配置
  - 安装
  - 运行时配置
- More Details
  - Functions and Statements which will spread the tainted mark of a tainted string
  - Functions and statements which will check tainted string
  - Functions which untaint the tainted string
- Taint 函数
  - is_tainted — Checks whether a string is tainted
  - taint — Taint a string
  - untaint — Untaint strings

`↑` and `↓` to navigate • `Enter` to select • `Esc` to close • `/` to open