php-expr-audit

Detecting expression injection in PHP involves tracing user-controlled input to dynamic execution points like eval() or ExpressionLanguage->evaluate(). This scanner identifies these expression evaluation entry points and outputs structured remediation guidance.

Expression injection in PHP occurs when user-controlled input reaches expression engines or dynamic execution functions, enabling potential code execution or secret logic manipulation. It often involves unsafe concatenation within over-permissive evaluation contexts.

Integrating static analysis into a CI pipeline flags expression-evaluation entry points during builds. Running the scanner against your codebase locates ExpressionLanguage and eval() risks, outputting structured reports with severity ratings to prevent deployment of vulnerable code.

Yes, the scanner detects PHP runtime execution via eval($code) and assert($assertion) during code reviews. It identifies sources of user-controlled input feeding into these execution chains and checks for unsafe concatenation or over-permissive evaluation contexts.

Static analysis for PHP expression injection focuses on detecting EXPR_EVAL_ENTRY, EXPR_CONTROL, and EXPR_EXEC_CHAIN_ENTRY traces in source code. It may not cover dynamic execution points obscured by complex runtime dependencies or heavily obfuscated data flows.