php-sql-audit

To audit PHP code for SQL injection, the Skill traces data flow from user-supplied inputs to SQL execution points. It identifies risks across PDO, mysqli, or ORM implementations and generates structured vulnerability reports with severity ratings and remediation guidance.

Data-flow tracing for SQL injection detection maps how user-supplied input travels through PHP source code to reach SQL execution sinks. By tracking this path, static analysis determines if the input can manipulate the query and verifies actual exploitability.

You trace user input to SQL execution points in PHP by running static and dynamic analysis on the source code. This identifies where external data enters and follows its path to PDO, mysqli, or ORM queries to assess injection risk.

Yes, this SQL injection analysis supports ORM frameworks alongside standard PDO and mysqli methods. It locates SQL execution points across these implementations to evaluate data-flow paths from user inputs to the final query sinks.

A PHP SQL injection vulnerability report includes severity ratings, proof-of-concept guidance, and remediation recommendations based on evidence. It maps user inputs to SQL execution points and final sinks to determine exploitability and satisfy data-flow tracing.

You need tracer results for code auditing when determining the exploitability of identified SQL execution points. Tracer results map the complete data-flow path from user input to the sink, providing the evidence required to assess injection risk and plan remediation.