php-injection-audit

Trace user input into SQL execution sinks like PDO::query, mysqli_query, and ORM Raw methods such as whereRaw or orderByRaw. Confirm whether prepare/execute parameter binding is complete, since string concatenation or sprintf %s interpolation into queries remains injectable even with partial escaping.

Search for exec, system, shell_exec, passthru, proc_open, popen, and backtick expressions, then check whether each argument segment is escaped. Note that combining escapeshellarg with escapeshellcmd can break quote pairing, while proc_open array mode avoids shell parsing entirely.

escapeshellarg alone is usually effective, but it can be bypassed when combined with escapeshellcmd, under certain multibyte locales like GBK, or when the argument abuses command flags rather than shell metacharacters. Multi-parameter commands still need every segment individually escaped.

Yes. Raw methods like whereRaw, havingRaw, orderByRaw, and selectRaw are not protected by ORM parameterization when variables are concatenated inside them. Dynamic ORDER BY and LIMIT clauses also cannot use bound parameters and require whitelisting or intval casting.

Source-level auditing only determines whether an injection is exploitable in code; it does not construct payloads or bypass WAFs at runtime, which belong to black-box exploitation. Sinks without EVID data flow evidence can only be marked as pending verification.