Re: Simple PHP scanning ..

On Sun, Mar 20, 2005 at 03:10:05AM +0100, Gerardo Di Giacomo wrote:

> rats doesn't check the execution functions ... it just check the
> backticks. And it doesn't check include and require families. We could
> modify the rats database for PHP with these new checks... what do you
> think? Steve?

  Modifying the database is less useful than it first appears because
 there's no notion of where things come from, and no differentiation
 between fixed (safe) strings, and variable arguments.

Steve
--