aboutsummaryrefslogtreecommitdiff
path: root/runtime/queries
diff options
context:
space:
mode:
authorIvan2023-03-10 22:56:18 +0000
committerGitHub2023-03-10 22:56:18 +0000
commit39073581032a015e5091497530a1b357854b4e99 (patch)
tree1c7d77e23f8018eae6bca264171c784734890f61 /runtime/queries
parent1661e4b5e1d8ebfef28f798fcb86ba2656373ba0 (diff)
queries/php: add injections for regex and sql injection (#6250)
Diffstat (limited to 'runtime/queries')
-rw-r--r--runtime/queries/php/injections.scm19
1 files changed, 19 insertions, 0 deletions
diff --git a/runtime/queries/php/injections.scm b/runtime/queries/php/injections.scm
index 614a3850..8d1b9740 100644
--- a/runtime/queries/php/injections.scm
+++ b/runtime/queries/php/injections.scm
@@ -4,3 +4,22 @@
((comment) @injection.content
(#set! injection.language "comment"))
+
+((function_call_expression
+ function: (name) @_function
+ arguments: (arguments . (argument (_ (string_value) @injection.content))))
+ (#match? @_function "^preg_")
+ (#set! injection.language "regex"))
+
+((function_call_expression
+ function: (name) @_function
+ arguments: (arguments (_) (argument (_ (string_value) @injection.content))))
+ (#match? @_function "^mysqli_")
+ (#set! injection.language "sql"))
+
+((member_call_expression
+ object: (_)
+ name: (name) @_function
+ arguments: (arguments . (argument (_ (string_value) @injection.content))))
+ (#match? @_function "^(prepare|query)$")
+ (#set! injection.language "sql"))