Runtime Configuration

The behaviour of these functions is affected by settings in php.ini.

Here's a short explanation of the configuration directives.

taint.enable bool

Master switch. When enabled, taint hooks the executor and marks strings from $_GET, $_POST and $_COOKIE as tainted at request startup.

This is an php.ini-only directive: enabling it requires a process restart, so it cannot be toggled per request or per directory.

Note:

Do not enable this directive in production environments: the instrumentation slows every request down and is incompatible with the OPcache JIT.

taint.error_level int

The error level used when taint reports a possibly tainted string. Defaults to E_USER_WARNING (512).

Because this directive is INI_ALL, it can be changed at runtime. For example, to silence taint warnings for the current script:

<?php
ini_set('taint.error_level', 0);
?>