laruence/taint
FreeTaint is a PHP extension, used for detecting XSS codes
FreeFree tier
About laruence/taint
Taint is a PHP extension developed by laruence that detects XSS (Cross-Site Scripting) codes by marking tainted strings originating from user input ($_GET, $_POST, $_COOKIE). When a tainted string is passed to sensitive functions like echo, print, include, mysql_query, or used in string concatenation that reaches such functions, Taint issues a warning. It can also be used to spot SQL injection vulnerabilities, shell injection, and other insecure data flows. The extension is installable via PECL and compiles on Linux (requires PHP 5.2+). It is intended for development and testing environments, not production, as it can slow down applications. Taint is not compatible with PHP 8.0+.
Key Features
Detects XSS codes by marking tainted strings from $_GET, $_POST, $_COOKIE
Warns when tainted data is used in dangerous functions (echo, print, include, mysql_query, etc.)
Can also spot SQL injection and shell injection vulnerabilities
Easy installation via PECL (pecl install taint) or manual compile on Linux
Allows disabling warnings per script via ini_set('taint.error_level', 0)
No source code patching required; implements RFC taint concept as a PHP extension
Pros & Cons
Pros
- Lightweight PHP extension that requires no code changes to existing applications
- Helps catch security vulnerabilities early in the development process
- Easy to install via PECL package manager
- Covers multiple vulnerability types (XSS, SQL injection, shell injection)
- Configurable error reporting level per script
Cons
- Intended only for development and testing; not suitable for production due to performance slowdown
- Not compatible with PHP 8.0+ (only supports PHP 5.2+ up to PHP 7.x)
- Warnings may generate false positives in some legitimate string-handling scenarios
- Requires manual compilation on Windows (config.w32 provided but limited documentation)
Best For
Detecting cross-site scripting (XSS) vulnerabilities in PHP applicationsSpotting SQL injection vulnerabilities during developmentIdentifying shell injection risks in PHP codeSecurity auditing and code review for PHP projectsTeaching and learning about taint analysis in web security
FAQ
What is Taint?
Taint is a PHP extension that detects XSS codes by tracking tainted strings from user input ($_GET, $_POST, $_COOKIE) and warning when they are used in sensitive functions like echo, print, include, and mysql_query.
How do I install Taint?
Taint can be installed via PECL with the command 'pecl install taint', or compiled from source on Linux using phpize and make.
What PHP versions are supported?
Taint requires PHP 5.2+ up to PHP 7.x. It is not compatible with PHP 8.0+ due to implementation complications.
Can I use Taint in production?
No, the developers advise against enabling Taint in production environments because it will slow down your application. It is designed for development and testing.