taint
(PECL taint >=0.1.0)
taint — Mark strings as tainted
Description
Manually marks the given strings as tainted, as if they had arrived
from user input. The variables are passed by reference, but the mark
itself is stored on the string rather than on the variable: every
variable sharing the same string becomes tainted at once.
This is mainly useful for testing, and for simulating user input in
CLI scripts where the $_GET,
$_POST and
$_COOKIE
superglobals are not populated.
Parameters
string-
A variable holding the string to mark.
strings-
Further variables to mark.
Return Values
Always returns true. When
taint.enable is off, the
function does nothing and still returns true.
Examples
Example #1 taint() example
<?php
$name = "world";
taint($name);
var_dump(is_tainted($name));
?>
The above example will output
something similar to:
Notes
Note:
Only non-empty strings are marked; variables holding other types, or
empty strings, are silently ignored.
Note:
Interned, persistent and permanent strings (string literals, opcache
shared strings) can never carry the mark and are silently skipped.
is_tainted
Taint Functions