Introduction

Taint is an extension for detecting XSS code (tainted strings). It can also be used to spot SQL injection, command injection, file path injection and similar vulnerabilities.

When taint is enabled, strings received from user input — $_GET, $_POST and $_COOKIE — are marked as tainted at request startup, and the mark is tracked through string operations. When a tainted string reaches a dangerous sink (output, SQL query, shell command, file path, ...), taint raises a warning pointing at that spot. See Propagation and Checked Sinks for the complete lists.

Taint is a development and auditing tool, not a runtime defense: it only reports possible problems and never blocks or alters data. It is deliberately conservative and may over-report, so a clean run means only "nothing taint could see", never "provably secure". Do not enable it in production environments.

<?php
$a = trim($_GET['a']);

$file_name = '/tmp/' . $a;
$output    = "Welcome, {$a} !!!";
$sql       = "SELECT * FROM users WHERE name = " . $a;

echo $output;
print $output;
include $file_name;
mysqli_query($link, $sql);
?>

Warning: main() [echo]: Attempt to echo a string that might be tainted in /path/to/script.php on line 9

Warning: main() [print]: Attempt to print a string that might be tainted in /path/to/script.php on line 10

Warning: main() [include]: File path contains data that might be tainted in /path/to/script.php on line 11

Warning: main() [mysqli_query]: SQL statement contains data that might be tainted in /path/to/script.php on line 12