03/12/2016 19:33:11: $pdo->prepare("UPDATE users SET avatar=? WHERE id=22 ")->execute([$u]) ;
It's pretty basic. For UPDATE, it's matching anything with UPDATE followed by SET, followed by a dollar sign+alphanumeric
And, it's specifically going after dynamic table names. Hmm.
'/UPDATE\s+.*?\$[a-zA-Z0-9].*?\sSET.*?/i', // UPDATE $table SET ...
... or by splitting the SQL string over multiple lines. Or building it up by concatenating strings. Let's stop this now, we've demonstrated that the code is very brittle :)
So people who use
"WHERE id=" . $_GET['id']
query("DELETE FROM foo WHERE id=1");$id=2;
$query="SELECT whatever from foo WHERE".
"id=$bar ".
"AND " .
"field=$value";- it's currently skipping variable names with underscores, and it's matching variable names that start with numbers, which isn't a valid variable name
- the false positives coming from ->execute($whatever) could be fixed by not searching after a > character. I don't think that would create any notable amount of false negatives.
Like, for example, changing:
'/UPDATE\s+.*?\sSET\s.*?\$[a-zA-Z0-9].*?/i'
'/UPDATE\s+.*?\sSET\s[^>]*?\$[a-zA-Z_]/i'