# VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application
## 1 Introduction  
PHP is a general-purpose scripting language for web development [1]. Since its birth, PHP has been called the world's best programming language by most developers. Currently, PHP still dominates the web-server-side programming languages. According to the W3 TECHS report, PHP topped the list of programming languages used by web applications as of September 2022, with a market share of 77.3% [2]. Because of its free and extensible features, PHP's open-source ecosystem has made vast and rapid progress, and there are now over 138K great PHP repositories on GitHub [3]. Nowadays, open-source software develops fast. Based on various existing PHP frameworks, developers can implement a PHP application more rapidly and conveniently than before and focus more on the business process. Unfortunately, the open-source code introduced by the developer may contain some buggy code, which will cause vulnerabilities such as cross-site scripting (XSS), SQL injection (SQLI), OS command injection (OSCI), etc. If developers copy and paste portions or a total of lib code from open software without security audits and modification, it will propagate the vulnerable code to the ongoing project [4]. The vulnerabilities contained in the open-source projects are easily discovered and exploited by hackers, posing a colossal threat [5]. Therefore, the problem of detectingvulnerabilities in web applications as early as possible is critical and worth paying more attention to. With the spreading use of PHP in server-side web application programming, any little security bugs may cause a colossal disaster [6]. BackupBuddy [7] is currently one of WordPress's best-selling site backup plugins. It allows users to back up their WordPress website from the dashboard, including users, posts, widgets, media files, and theme files. On 9 September 2022, a WordPress security company Wordfence disclosed BackupBuddy's zero-day flaw CVE-2022-31474 [8], with a CVSS score of 7.5. The flaw makes it possible for unauthorized users to access and view arbitrary files from the vulnerable website, which may contain secret information, such as the WordPress \"wp-config.php\" file, \"/etc/passwd\" file, etc. Analyzing the source code characteristics and discovering the weakness is consistently one of the effective methods for vulnerability detection [9]. In the past, people used manual auditing to test the security of PHP programs. It was not only complex but also wasted time and labor. Moreover, it cannot handle the current large open-source codes. Currently, the traditional method uses the regex pattern to search the flaws' patterns in PHP source code, which depends on the detective vulnerable features extracted from human experts' experience. So, it is often not feasible for the complicated vulnerabilities. Since machine learning technology is developing fast, more and more researchers have dived into seeking methods using artificial intelligence to find vulnerabilities automatically, and it has been proven to be feasible. The traditional ways of PHP vulnerability detection [10; 11; 12] are based on static, flow, and taint analysis tools, along with manual auditing. They need more labor and are inefficient in finding flaws in large-scale PHP project files. With the development of artificial intelligence, machine learning and deep learning approaches have proved suitable for software vulnerability detection. The data mining methods [13; 14; 15; 16] require manually extracting the characteristics of vulnerabilities, which relies on rich expert knowledge and costs much labor time and suffers from poor detection performance, with higher false negatives and false positives. The deep-learning-based approach [6; 17; 18] transforms the source code into a custom token sequence and feeds it into natural language models to extract the features of vulnerabilities, then classifies them to be vulnerable or not. All these solutions can atomically capture the context information of the vulnerability in the PHP source code.