Add a function to check if a variable is made from string constants

[craigfrancis]

Having tried the taint extension for a while, I find that it does a good job at identifying most issues, while only requiring minor tweaks to my code to avoid warnings.

However there are a few exceptions which can't be covered with the current implementation, for example mysqli_real_escape_string() without quote marks (see pg_escape_literal for comparison), or using preg_replace to sanitise a string.

So taking the idea from Matt Tait - https://wiki.php.net/rfc/sql_injection_protection

Would it be possible to keep the current implementation, but add a second flag that tracks if a variable has only been built from T_STRING constants?

Then add a new function that allows the programmer to check the variable is made from string constants, maybe with a function named is_string_constant, or is_static, etc.

This means the following could be possible to check for SQLi:

<?php

	class db {
		function fetch_row($sql, $parameters) {
			if (!is_string_constant($sql)) {
				throw new Exception('Not a static string.');
			}
			// ...
		}
		// ...
	}

?>
<?php

	define('SQL_TABLE_PREFIX', 'abc_');

	if ($_GET['order'] == 'desc') {
		$sql_order = 'DESC';
	} else {
		$sql_order = 'ASC';
	}

	$sql = 'SELECT
			*
		FROM
			' . SQL_TABLE_PREFIX . 'table
		WHERE
			field = ?
		ORDER BY
			field ' . $sql_order;
			
	$parameters = array();
	$parameters[] = array('s', $unsafe_var);

	if ($row = $db->fetch_row($sql, $parameters)) {
		// It works :-)
	}

?>

And likewise, a framework could provide a wrapper to exec/shell_exec/system/passthru which supports a form of parameterized command, while checking that the command itself if made from string constants.