Where taint raises warnings

When a tainted string reaches one of the sinks below, taint raises a warning (by default an E_USER_WARNING; the level is configurable via taint.error_level). Only top-level string arguments are inspected; dumping an array that merely contains tainted values does not warn.

Output sinks

Sink	Checked
echo, print	the echoed/printed expression
printf(), vprintf()	the format string and the substituted values
print_r(), var_dump(), var_export()	the value being dumped, when it is a string
exit/die with a message	the message
file_put_contents(), fwrite(), fputs() to php://output	the data being written

Filesystem sinks

Sink	Checked
fopen(), opendir(), unlink()	the path
file(), readfile(), file_get_contents(), highlight_file()/show_source()	the path
copy(), rename(), move_uploaded_file()	both the source and destination paths
mkdir(), rmdir(), touch()	the path
include, include_once, require, require_once	the file path

SQL sinks

Sink	Checked
mysqli_query(), mysqli_prepare(), mysqli_real_query(), mysqli_multi_query()	the query string
mysql_query(), sqlite_query(), sqlite_single_query(), oci_parse(), pg_query(), pg_send_query()	the query string
mysqli::query(), mysqli::prepare(), mysqli::real_query(), mysqli::multi_query()	the query string
PDO::query(), PDO::prepare(), PDO::exec()	the query string
SQLite3::query(), SQLite3::prepare(), SQLite3::exec(), SQLiteDatabase::query(), SQLiteDatabase::singleQuery()	the query string

Command execution sinks

Sink	Checked
exec(), system(), passthru(), shell_exec() (including the backtick operator)	the command string
proc_open(), popen()	the command string
eval	the evaluated code
dynamic calls such as $func(), $obj->$method(), call_user_func(), array callables	the function/method/class name being resolved
preg_match(), preg_match_all(), preg_replace(), preg_split(), preg_grep(), preg_replace_callback()	the pattern (and the callback name for preg_replace_callback())

Header and cookie sinks

Sink	Checked
header()	the header string
setcookie(), setrawcookie()	the cookie name and value

Other sinks

Sink	Checked
unserialize()	the serialized string
mail()	to, subject, additional parameters and additional headers (the message body is content and is not checked)

Warnings follow the format function_name() [sink]: message, where sink identifies the checked operation (for example echo, include or the function name) and the message describes what was found to be possibly tainted.