Home/ Manual/ taint / functions/ taint

taint

PHP function Edit on GitHub ✎

(PECL taint >=0.1.0)

Mark strings as tainted

Description

taint(string $string, string ...$strings): bool

Manually marks the given strings as tainted, as if they had arrived from user input. The variables are passed by reference, but the mark itself is stored on the string rather than on the variable: every variable sharing the same string becomes tainted at once.

This is mainly useful for testing, and for simulating user input in CLI scripts where the $_GET, $_POST and $_COOKIE superglobals are not populated.

Parameters

string: A variable holding the string to mark.
strings: Further variables to mark.

Return Values

Always returns true. When taint.enable is off, the function does nothing and still returns true.

Examples

taint() example

php

<?php
$name = "world";
taint($name);
var_dump(is_tainted($name));
?>

The above example will output something similar to:

output

bool(true)

Notes

Note

Only non-empty strings are marked; variables holding other types, or empty strings, are silently ignored.