Taint supports PHP 8 now!中文EN

What is Taint:

Among my open source projects, Taint is the only one I ever actively "abandoned" — because maintaining it got too hard.

In a nutshell, Taint is a PHP extension that detects XSS / SQL / Shell injection vulnerabilities. When your PHP code tries to use a string that came from external input directly, Taint warns you:

Warning: mysql_query() [function.mysql-query]: First argument contains data that might be tainted in xxx.php on line x

The principle is simple as well: every string coming from outside, say from $_GET or $_POST, gets marked. Taint then hijacks the PHP opcode handlers that may "copy" such strings — if the string is not sanitized, the mark keeps propagating through every copy.

The project was first released in 2012.

But once PHP 8 arrived, with the JIT and a large amount of internal rewrites, I judged the migration cost to be too high, too difficult, honestly almost impossible. The taint marks used to live in GC_FLAGS, and after PHP 8.0 there is not a single bit left available. On top of that, those bits are deeply internal — which means keeping the extension alive requires me to watch their usage constantly, and adapt whenever something breaks.

Besides, Taint hijacks a large number of PHP methods and opcode handlers to keep the taint information propagating. That basically means re-implementing the same behavior while making sure the taint bits are never dropped — so I would also have to track changes to all those methods and opcode handlers, and mirror them in Taint whenever PHP changes.

It was just too complex. And at the time I was also maintaining PHP itself plus several of my other projects, and it is a rather unglamorous, purely manual kind of work. So...

I declared the project unmaintained.

The turning point for Taint:

These days, vibe coding has become a real new form of productivity. I had actually never seriously considered letting an AI do this job — it felt too complex, requiring a lot of knowledge of PHP's internal definitions and implementation details. A few days ago, Alibaba released Qwen-3.8, a 2.4T model that emphasizes its coding ability, and I decided to give it a try.

My local setup is Obsidian + Claudian + CC Switch, running qwen-3.8-max. Everything started with a single sentence I gave it (of course I have the php-src source, Taint's own code, and the source of my other open source projects locally, all available for it to browse):

I did not have many expectations at first — I thought it was hard even for myself. Partway through I saw it:

So I assumed it was going to fail. After a long while I noticed it had been paging through all kinds of definitions in php-src — it seemed to have understood what Taint was trying to do and had a path to an implementation, verifying one hypothesis after another. And after a long while more...

Wait, what? Are you full of it, haha. So I let it go ahead. It went to work and kept crunching away for hours, completely silent. I stepped out for a long meeting in the middle, and when I came back it was still crunching:

It crunched away for a long time, and then it was done!

After about half an hour of my review, I concluded that it is, most likely, looking, reasonably reliable. I think the coding ability of Qwen-3.8-Max is solid — good enough for my day-to-day project maintenance needs. ...

To sum up:

The whole process took almost 5 hours. It consumed 200 million tokens in total today (there was some other work in there, but the impact should be minor), at a cost of 406 RMB. To be fair, that is quite a lot — for a project of only 2,000+ lines, most of the tokens probably went into understanding the fine details of PHP's massive codebase. Similar projects in the future should leave a lot of room for improvement.

The PHP 8 adaptation of Taint is done. Going forward I just need to have the AI check PHP's changelog from time to time, and whenever there is an update, adjust Taint accordingly.

One last thing I want to say:

In today's world, the idea may matter more, while the actual execution can genuinely be done by AI — and it gets more and more capable.

Very often, the only limit on what we let AI do is whether we dare to try. Tokens keep getting cheaper, after all. ?...

The PHP 8 version of Taint is already on my GitHub repo. Welcome to come and check out Qwen's code. ...

https://github.com/laruence/taint

Note: This article was automatically synced from the WeChat Official Account "Fengxue Zhiyu" by Jarvis (the author's AI assistant).

---

Read the original on WeChat: "Taint supports PHP 8 now! - The Qwen 3.8 Coding Challenge"