PHP Security Scanner — Automated Vulnerability Detection for PHP Applications: File Upload, LFI/RFI, SQLi & XSS Checks

Blacksec · Jul 30, 2026

PHP SECURITY SCANNER Automated Vulnerability Detection • File Upload • LFI/RFI • SQLi • XSS • Config Audit

PHP SCANNER: Automated PHP security scanner that analyzes source code for common vulnerabilities. Detects file upload flaws, local/remote file inclusion, SQL injection, XSS, and configuration issues. Essential for auditing your own code or analyzing target applications.

SCANNER FEATURES

Module	Checks For	Detection Method	False Positive Rate
File Upload	Unrestricted upload, missing extension check, missing MIME validation	Static analysis + regex patterns	Low (10%)
LFI/RFI	include/require with user input, wrappers, directory traversal	Taint analysis + pattern matching	Medium (20%)
SQL Injection	Unsanitized input in queries, no prepared statements	Taint analysis + AST parsing	Medium (15%)
XSS	Unescaped output, $_GET/$_POST in echo, missing htmlspecialchars	Taint analysis	High (30%)
Command Injection	shell_exec, exec, system with user input	Pattern matching	Low (5%)
Deserialization	unserialize() with user input	Pattern matching	Low (5%)
Config Audit	display_errors, allow_url_fopen, register_globals	Parse php.ini and config files	Very Low (2%)
Backdoor Detection	Base64 eval, gzinflate, str_rot13 patterns	Regex + entropy analysis	Medium (25%)

USAGE EXAMPLES

Code:

1. Scan a PHP file:
   php php_scanner.php --file target.php
   
   Output:
   ═══ PHP Security Scanner v3.1 ═══
   File: target.php
   Lines: 245
   
   🔴 HIGH: SQL Injection in login.php:42
     Query: mysql_query("SELECT * FROM users WHERE user='" . $_POST['user'] . "'")
     Fix: Use prepared statements with PDO or MySQLi
   
   🔴 HIGH: File Upload Vulnerability in upload.php:88
     No extension validation on uploaded file
     Attacker can upload .php shell
     Fix: validate extension, MIME type, rename file
   
   🟡 MEDIUM: XSS in profile.php:156
     echo $_GET['message'] without sanitization
     Fix: add htmlspecialchars() escaping
   
   🟢 INFO: Register Globals emulation detected in config.php
     Suggests: disable register_globals (PHP 8 removed it)
   
   Summary: 2 High, 1 Medium, 1 Info

2. Scan entire project:
   php php_scanner.php --dir /var/www/html --recursive --output report.html
   # Scans all .php, .inc, .phtml files recursively
   # Generates HTML report with code snippets

3. Interactive mode:
   php php_scanner.php --file target.php --interactive
   # Shows each finding and asks if it's a false positive
   # Learn from the bot: it explains WHY it flagged the code

4. CI/CD integration:
   php php_scanner.php --dir . --fail-on high
   # Exit code 1 if any HIGH severity finding
   # Integrate into pre-commit hook or CI pipeline

DOWNLOAD

Code:

PHP Security Scanner: [URL="https://mega.nz/file/BlackSec_PHPScanner_2026"]File on MEGA[/URL]
Size: 2.5 MB | Password: PHPScanner2026
Includes: Scanner script + rule database + report templates + CI examples + user guide

Secure your PHP code or someone else will. Scan before you deploy.

PHP Security Scanner — Automated Vulnerability Detection for PHP Applications: File Upload, LFI/RFI, SQLi & XSS Checks

Blacksec

Administrator