Taint-0.3.0 (An XSS codes sniffer) released中文EN

In the past few days, I've been improving taint in my spare moments. Today I feel I've finally reached about 80% satisfaction, and by the 80:20 rule, I think it can count as a milestone version :).
What is Taint? An extension used for detecting XSS codes (tainted string), And also can be used to spot sql injection vulnerabilities, shell inject, etc.
Through my actual testing, Taint-0.3.0 can detect hidden XSS code, SQL injection, Shell injection and other vulnerabilities in some real open-source products (don't ask which ones), and these vulnerabilities would be very difficult to track down using static analysis tools. For example, for the following case:

<?php
   $name = $_GET["name"];
   $value = strval($_GET["tainted"]);
   echo $$name;

For the request:

http://****.com/?name=value&tainted=xxx

Static analysis tools are often powerless, whereas Taint can pinpoint this type of issue with complete accuracy.

Warning: main() [function.echo]:
     Attempt to echo a string that might be tainted in %s.php on line %d

Now 0.3.0 has been released, and I think I won't be adding new features in the near term. enjoy, PHP Taint.
In addition, let me add one more thing: Taint can be said to be the most complex extension I've ever completed. It uses all kinds of tricky techniques. If you're interested in extension development, it can serve as a very good advanced reference.
Appendix:
A. Tainted String
All variables from $_GET, $_POST, $_COOKIE are considered Tainted Strings
B. The list of functions/statements checked by taint. When these functions use a tainted string argument, taint will issue a warning:
1. Output functions/statements family

echo
print
printf
file_put_contents

2. File system functions

fopen
opendir
basename
dirname
file
pathinfo

3. Database family functions/methods

mysql_query
mysqli_query
sqlite_query
sqlite_single_query
oci_parse
Mysqli::query
SqliteDataBase::query
SqliteDataBase::SingleQuery
PDO::query
PDO::prepare

4. Command-line family

system
exec
proc_open
passthru
shell_exec

5. Syntax structures

eval
include(_once)
require(_once)

C. Functions that remove the tainted information. After calling these functions, the tainted string becomes a legitimate string:

escapeshellcmd
htmlspecialchars
escapeshellcmd
addcslashes
addslashes
mysqli_escape_string
mysql_real_escape_string
mysql_escape_string
sqlite_escape_string
PDO::quote
Mysqli::escape_string
Mysql::real_escape_string

D. Functions/statements that preserve the tainted information during the call. When calling these functions/statements, if the input is a tainted string, then the output is also a tainted string:

= (assign)
. (concat)
"{$var}" (variable substitution)
.= (assign concat)
strval
explode
implode
sprintf
vsprintf
trim(as of 0.4.0)
rtrim(as of 0.4.0)
ltrim(as of 0.4.0)

E. Links:

• RFC:Taint (the idea mostly comes from this RFC)