php-sql-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

PHP SQL 注入审计（php-sql-audit）

PHP SQL Injection Audit (php-sql-audit)

分析 PHP 项目源码，识别 SQL 执行相关代码（PDO/mysqli/ORM），追踪用户输入到 SQL 构造点，验证是否存在 SQL 注入，并输出完整漏洞报告。

Analyze PHP project source code, identify SQL execution-related code (PDO/mysqli/ORM), track user input to SQL construction points, verify whether SQL injection exists, and output a complete vulnerability report.

CRITICAL：禁止省略与禁止误报

CRITICAL: No Omissions and No False Positives

必须审计所有在路由参数中出现的字符串来源（GET/POST/Body/参数字段）进入 SQL 的路径
必须使用“数据流追踪证据”判定可利用性；不得只靠关键字猜测
禁止省略：不得出现任何省略占位符；必须输出完整的漏洞证据链与修复建议

Must audit all paths where string sources appearing in route parameters (GET/POST/Body/parameter fields) enter SQL
Must use "data flow tracking evidence" to determine exploitability; keyword guessing alone is not allowed
No omissions: No omission placeholders are allowed; complete vulnerability evidence chain and repair suggestions must be output

分级与编号

Grading and Numbering

详见：
```
shared/SEVERITY_RATING.md
```
漏洞编号：
```
{C/H/M/L}-SQL-{序号}
```

See details:
```
shared/SEVERITY_RATING.md
```
Vulnerability ID:
```
{C/H/M/L}-SQL-{serial number}
```

输入依赖

Input Dependencies

建议至少有（与

shared/IO_PATH_CONVENTION.md

一致；合并流水线时读总报告中等价章节即可）：

routes_{timestamp}.md

（独立落盘时常为

route_mapping/routes_{timestamp}.md

）

params_{timestamp}.md

（独立落盘时常为

route_mapping/params_{timestamp}.md

）可选但推荐：

```
route_tracer/
```
输出，用于精准判定参数实际使用状态

It is recommended to have at least (consistent with

shared/IO_PATH_CONVENTION.md

; you can read the equivalent section in the total report when merging pipelines):

routes_{timestamp}.md

(when stored independently, it is often

route_mapping/routes_{timestamp}.md

)

```
params_{timestamp}.md
```
(when stored independently, it is often
```
route_mapping/params_{timestamp}.md
```
) Optional but recommended:
Output from
```
route_tracer/
```
, used to accurately determine the actual usage status of parameters

SQL Sink 识别（必做）

SQL Sink Identification (Mandatory)

PDO / PDOStatement
- 相对危险：
```
$pdo->query($sql)
```
  /
```
$pdo->exec($sql)
```
  （若 $sql 来自拼接/包含用户输入）
- 形式检查：
```
$pdo->prepare($sql)
```
  只有在
```
$sql
```
  中使用占位符且后续
```
bindParam/bindValue
```
  或正确传参时更安全
- ORM/DB 包装：
```
DB::select(DB::raw({value}))
```
  、Doctrine
```
createQuery
```
  等
mysqli / mysqli_stmt
- ```
mysqli_query($conn, $sql)
```
  拼接危险
- ```
mysqli_prepare
```
  只有 prepare + bind 正确时才可能安全
典型危险构造模式（必做）
- SQL 字符串与变量拼接：
```
.
```
  ,
```
sprintf
```
  ,
```
vsprintf
```
  ,
```
implode/join
```
  + SQL 关键字
- 动态排序：
```
order by $x
```
  /
```
ORDER BY ".$x."
```
  （常见高危）

PDO / PDOStatement
- Relatively risky:
```
$pdo->query($sql)
```
  /
```
$pdo->exec($sql)
```
  (if $sql comes from concatenation/contains user input)
- Formal check:
```
$pdo->prepare($sql)
```
  is safer only when placeholders are used in
```
$sql
```
  and subsequent
```
bindParam/bindValue
```
  or correct parameter passing is performed
- ORM/DB wrapper:
```
DB::select(DB::raw({value}))
```
  , Doctrine
```
createQuery
```
  , etc.
mysqli / mysqli_stmt
- ```
mysqli_query($conn, $sql)
```
  concatenation is risky
- ```
mysqli_prepare
```
  may only be safe when prepare + bind is done correctly
Typical dangerous construction patterns (Mandatory)
- SQL string and variable concatenation:
```
.
```
  ,
```
sprintf
```
  ,
```
vsprintf
```
  ,
```
implode/join
```
  + SQL keywords
- Dynamic sorting:
```
order by $x
```
  /
```
ORDER BY \".$x.\"
```
  (commonly high-risk)

需要触发 tracer 的条件（必做）

Conditions for Triggering Tracer (Mandatory)

满足任一条时必须调用

php-route-tracer

（或同等追踪证据）：

参数经过多层传递或 JSON 解码后取字段进入 SQL
SQL 构造点位于基类/工具类/父函数中
存在分支条件（if/try/catch）导致 SQL 是否执行不确定

Call

php-route-tracer

(or equivalent tracking evidence) when any of the following conditions are met:

Parameters enter SQL after multi-layer transmission or JSON decoding to retrieve fields
SQL construction points are located in base classes/utility classes/parent functions
Branch conditions (if/try/catch) exist that make SQL execution uncertain

报告输出

Report Output

输出到：

{output_path}/vuln_audit/
└── sql_{timestamp}.md

Output to:

{output_path}/vuln_audit/
└── sql_{timestamp}.md

漏洞报告条目模板（强制）

Vulnerability Report Entry Template (Mandatory)

markdown

undefined

markdown

undefined

[{等级前缀}-SQL-{序号}] {风险标题}

[{Severity Prefix}-SQL-{Serial Number}] {Risk Title}

项目	信息
严重等级	{🔴/🟠/🟡/🔵} (CVSS {score})
可达性 (R)	{0-3} - {理由}
影响范围 (I)	{0-3} - {理由}
利用复杂度 (C)	{0-3} - {理由}
可利用性	✅ 已确认 / ⚠️ 待验证 / ❌ 不可利用 / 🔍 环境依赖
位置	{file}:{line} ({Function/Class})

Item	Information
Severity Level	{🔴/🟠/🟡/🔵} (CVSS {score})
Reachability (R)	{0-3} - {Reason}
Impact Scope (I)	{0-3} - {Reason}
Exploit Complexity (C)	{0-3} - {Reason}
Exploitability	✅ Confirmed / ⚠️ Pending Verification / ❌ Not Exploitable / 🔍 Environment Dependent
Location	{file}:{line} ({Function/Class})

数据流链（Source → Sink）

Data Flow Chain (Source → Sink)

（按路由逐行写出：请求参数读取 -> 变量赋值/拼接/转换 -> 分支 -> SQL 进入执行点。禁止省略）

(Write line by line by route: Request parameter reading -> Variable assignment/concatenation/conversion -> Branch -> SQL enters execution point. No omissions allowed)

可利用前置条件

Preconditions for Exploitation

鉴权要求：{无需/需登录/需特定权限}
输入可控性：{完全可控/条件可控/不可控}
触发条件：{分支/异常/环境依赖}

Authentication Requirements: {None/Login Required/Specific Permission Required}
Input Controllability: {Fully Controllable/Conditionally Controllable/Uncontrollable}
Trigger Conditions: {Branch/Exception/Environment Dependence}

证据引用（强制：来自 php-route-tracer）

Evidence Reference (Mandatory: from php-route-tracer)

每条 SQL 疑似漏洞必须逐项引用 trace 输出中

## 9) Sink Evidence Type Checklist

的 SQL 行对应证据要点（允许状态为待验证，但证据引用必须存在）：

```
EVID_SQL_EXEC_POINT
```
：SQL 执行函数/语句位置（对应 trace 的 SQL 执行点证据）
```
EVID_SQL_STRING_CONSTRUCTION
```
：SQL 字符串构造/拼接位置（对应 trace 的 SQL 拼接证据）
```
EVID_SQL_USER_PARAM_TO_SQL_FRAGMENT
```
：用户可控参数到 SQL 片段的映射（对应 trace 的可控性矩阵字段证据）

Each suspected SQL vulnerability must reference the corresponding key points of the SQL line in

## 9) Sink Evidence Type Checklist

from the trace output (status can be pending verification, but evidence reference must exist):

```
EVID_SQL_EXEC_POINT
```
: SQL execution function/statement location (corresponding to the SQL execution point evidence of the trace)
```
EVID_SQL_STRING_CONSTRUCTION
```
: SQL string construction/concatenation location (corresponding to the SQL concatenation evidence of the trace)
```
EVID_SQL_USER_PARAM_TO_SQL_FRAGMENT
```
: Mapping of user-controllable parameters to SQL fragments (corresponding to the controllability matrix field evidence of the trace)

tracer 证据缺失处理（强制）

Handling Missing Tracer Evidence (Mandatory)

若无法定位上述 1~3 任一关键证据要点：该漏洞状态只能标记为
```
⚠️待验证
```
，不得直接给出
```
✅已确认可利用
```
。

If any of the key evidence points 1~3 above cannot be located: The vulnerability status can only be marked as
```
⚠️Pending Verification
```
, and
```
✅Confirmed Exploitable
```
cannot be directly given.

验证 PoC（强制，可执行请求）

Verification PoC (Mandatory, Executable Request)

http

{HTTP Method} {完整路径与查询/Body} HTTP/1.1
Host: {host}
{必要 Header/Session/JWT/Cookie}

{Payload}

http

{HTTP Method} {Full Path and Query/Body} HTTP/1.1
Host: {host}
{Necessary Header/Session/JWT/Cookie}

{Payload}

建议修复

Repair Suggestions

给出安全写法要点（PDO prepare + bind 且保证 SQL 片段不拼接用户输入）
给出代码搜索语句（
```
rg
```
/
```
grep
```
风格）用于定位所有同类拼接点

undefined

Provide key points of secure writing (PDO prepare + bind and ensure SQL fragments do not concatenate user input)
Provide code search statements (
```
rg
```
/
```
grep
```
style) to locate all similar concatenation points

undefined

输出完整性检查（强制）

Output Completeness Check (Mandatory)

至少输出：风险统计 + 每条漏洞完整条目
不出现任何省略占位符
每条漏洞都包含：数据流链、可利用前置条件、可执行 PoC、修复建议

At least output: Risk statistics + complete entries for each vulnerability
No omission placeholders appear
Each vulnerability includes: Data flow chain, preconditions for exploitation, executable PoC, repair suggestions",