PHP source review

When it applies

Reviewing PHP source (a repo, a PR, or a leaked webroot). PHP's defaults and dynamic features make several classes easy to introduce, so a grep-then-trace pass finds most of them fast.

Why it works

Many PHP sinks execute or include whatever string they're given, and loose typing turns comparison and casting into logic bugs. Tracing each sink back to a request source ($_GET/$_POST/$_REQUEST/ $_COOKIE/$_SERVER, php://input) tells you which are actually reachable.

Sinks & patterns (grep, then trace to user input)

• Code exec: eval, assert, preg_replace with /e, create_function, call_user_func(_array).
• Command exec: system, exec, shell_exec, passthru, proc_open, popen, backticks.
• File include (LFI/RFI): include/require(_once) with a variable; allow_url_include.
• SQLi: string-interpolated queries into mysqli_query/PDO::query (vs prepared statements).
• Deserialization: unserialize() on input (POP chains); phar:// via file functions.
• File / path: file_get_contents, fopen, readfile, move_uploaded_file with user paths.
• Other: extract() on input (variable overwrite), parse_str, SSRF via curl/file_get_contents.