Taint ConfigureOptions

Runtime Runtime

Title

taint.enablebool

Master switch. When enabled, taint hooks the executor and marks strings from $_GET, $_POST and $_COOKIE as tainted at request startup.

This is an Ini-only directive: enabling it requires a process restart, so it cannot be toggled per request or per directory.

Note

Do not enable this directive in production environments: the instrumentation slows every request down and is incompatible with the OPcache JIT.

taint.error_levelint

The error level used when taint reports a possibly tainted string. Defaults to E_USER_WARNING (512).

Because this directive is INI_ALL, it can be changed at runtime. For example, to silence taint warnings for the current script:

phpCopy

<?php
ini_set('taint.error_level', 0);
?>