PHP SQL Injection Audit (php-sql-audit)

Analyze PHP project source code, identify SQL execution-related code (PDO/mysqli/ORM), track user input to SQL construction points, verify whether SQL injection exists, and output a complete vulnerability report.

CRITICAL: No Omissions and No False Positives

Must audit all paths where string sources appearing in route parameters (GET/POST/Body/parameter fields) enter SQL
Must use "data flow tracking evidence" to determine exploitability; keyword guessing alone is not allowed
No omissions: No omission placeholders are allowed; complete vulnerability evidence chain and repair suggestions must be output

Grading and Numbering

See details:
```
shared/SEVERITY_RATING.md
```
Vulnerability ID:
```
{C/H/M/L}-SQL-{serial number}
```

Input Dependencies

It is recommended to have at least (consistent with

shared/IO_PATH_CONVENTION.md

; you can read the equivalent section in the total report when merging pipelines):

routes_{timestamp}.md

(when stored independently, it is often

route_mapping/routes_{timestamp}.md

)

```
params_{timestamp}.md
```
(when stored independently, it is often
```
route_mapping/params_{timestamp}.md
```
) Optional but recommended:
Output from
```
route_tracer/
```
, used to accurately determine the actual usage status of parameters

SQL Sink Identification (Mandatory)

PDO / PDOStatement
- Relatively risky:
```
$pdo->query($sql)
```
  /
```
$pdo->exec($sql)
```
  (if $sql comes from concatenation/contains user input)
- Formal check:
```
$pdo->prepare($sql)
```
  is safer only when placeholders are used in
```
$sql
```
  and subsequent
```
bindParam/bindValue
```
  or correct parameter passing is performed
- ORM/DB wrapper:
```
DB::select(DB::raw({value}))
```
  , Doctrine
```
createQuery
```
  , etc.
mysqli / mysqli_stmt
- ```
mysqli_query($conn, $sql)
```
  concatenation is risky
- ```
mysqli_prepare
```
  may only be safe when prepare + bind is done correctly
Typical dangerous construction patterns (Mandatory)
- SQL string and variable concatenation:
```
.
```
  ,
```
sprintf
```
  ,
```
vsprintf
```
  ,
```
implode/join
```
  + SQL keywords
- Dynamic sorting:
```
order by $x
```
  /
```
ORDER BY \".$x.\"
```
  (commonly high-risk)

Conditions for Triggering Tracer (Mandatory)

Call

php-route-tracer

(or equivalent tracking evidence) when any of the following conditions are met:

Parameters enter SQL after multi-layer transmission or JSON decoding to retrieve fields
SQL construction points are located in base classes/utility classes/parent functions
Branch conditions (if/try/catch) exist that make SQL execution uncertain

Report Output

Output to:

{output_path}/vuln_audit/
└── sql_{timestamp}.md

Vulnerability Report Entry Template (Mandatory)

markdown

### [{Severity Prefix}-SQL-{Serial Number}] {Risk Title}

| Item | Information |
|------|------|
| Severity Level | {🔴/🟠/🟡/🔵} (CVSS {score}) |
| Reachability (R) | {0-3} - {Reason} |
| Impact Scope (I) | {0-3} - {Reason} |
| Exploit Complexity (C) | {0-3} - {Reason} |
| Exploitability | ✅ Confirmed / ⚠️ Pending Verification / ❌ Not Exploitable / 🔍 Environment Dependent |
| Location | {file}:{line} ({Function/Class}) |

#### Data Flow Chain (Source → Sink)
(Write line by line by route: Request parameter reading -> Variable assignment/concatenation/conversion -> Branch -> SQL enters execution point. No omissions allowed)

#### Preconditions for Exploitation
- Authentication Requirements: {None/Login Required/Specific Permission Required}
- Input Controllability: {Fully Controllable/Conditionally Controllable/Uncontrollable}
- Trigger Conditions: {Branch/Exception/Environment Dependence}

#### Evidence Reference (Mandatory: from php-route-tracer)
Each suspected SQL vulnerability must reference the corresponding key points of the **SQL line** in `## 9) Sink Evidence Type Checklist` from the trace output (status can be pending verification, but evidence reference must exist):
1. `EVID_SQL_EXEC_POINT`: SQL execution function/statement location (corresponding to the SQL execution point evidence of the trace)
2. `EVID_SQL_STRING_CONSTRUCTION`: SQL string construction/concatenation location (corresponding to the SQL concatenation evidence of the trace)
3. `EVID_SQL_USER_PARAM_TO_SQL_FRAGMENT`: Mapping of user-controllable parameters to SQL fragments (corresponding to the controllability matrix field evidence of the trace)

#### Handling Missing Tracer Evidence (Mandatory)
- If any of the key evidence points 1~3 above cannot be located: The vulnerability status can only be marked as `⚠️Pending Verification`, and `✅Confirmed Exploitable` cannot be directly given.

#### Verification PoC (Mandatory, Executable Request)
```http
{HTTP Method} {Full Path and Query/Body} HTTP/1.1
Host: {host}
{Necessary Header/Session/JWT/Cookie}

{Payload}

Repair Suggestions

Provide key points of secure writing (PDO prepare + bind and ensure SQL fragments do not concatenate user input)
Provide code search statements (
```
rg
```
/
```
grep
```
style) to locate all similar concatenation points


## Output Completeness Check (Mandatory)
- [ ] At least output: Risk statistics + complete entries for each vulnerability
- [ ] No omission placeholders appear
- [ ] Each vulnerability includes: Data flow chain, preconditions for exploitation, executable PoC, repair suggestions",

php-sql-audit

NPX Install

Tags

SKILL.md Content (Chinese)