php.yml

# PHP: sources = user-manipulable (parser normalizes without $ → _POST, _GET, etc.)
sources:
  # Query string
  - "_GET"
  # POST body / form / JSON
  - "_POST"
  # GET + POST + COOKIE combined
  - "_REQUEST"
  # Cookies (user sends them)
  - "_COOKIE"
  # Server/env: HTTP_* headers (HTTP_HOST, HTTP_USER_AGENT, HTTP_REFERER, HTTP_X_*, etc.)
  - "_SERVER"
  # Environment variables
  - "_ENV"
  # File uploads (user-controlled filename + content)
  - "_FILES"
  # Session (often user-origin data)
  - "_SESSION"
  # Global scope
  - "GLOBALS"
sinks:
  - "exec"
  - "shell_exec"
  - "system"
  - "passthru"
  - "eval"
  - "popen"
  - "proc_open"
sanitizers:
  - "htmlspecialchars"
  - "htmlentities"
  - "mysqli_real_escape_string"
  - "strip_tags"
  - "sanitize"