# VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application
## 3 Background
### PHP Common Vulnerability  
A software vulnerability is an application error made by software developers, which malicious actors can use to access the system or network [37]. The most dangerous software vulnerability ranking of \"2022 CWE Top 25\" [38] includes the common vulnerabilities in the current web application ecosystem. The top five web application vulnerabilities include cross-site scripting (XSS or CWE-79), SQL injection (SQLI or CWE-89), OS command injection (OSCI or CWE-78), path traversal (PTR or CWE-22), and cross-domain request forgery (CSRF or CEW-352), ranking of two, three, six, eight, and nine, respectively. We pick up the top-ranking three vulnerabilities for illustration.  
**XSS (cross-site scripting)**  is a vulnerability caused by the absence or poor implementation of filtering when data are input or output. An attacker can inject arbitrary javascript into HTML files through this vulnerability. A successful cross-site scripting attack can lead to various evil actions, including personal information leaks such as session cookies or requesting a harmful web application. The example code Listing 1 shows an XSS vulnerability in an actual web application. Based on this example, the flaw occurs in code line 6. The _$_POST[\"name\"]_ input is not filtered before the printout. Therefore, an attacker can induce the victim to insert _<script>_ tags controlled by the attacker into the browser page, thereby enabling any malicious client behavior.  
```
0<?php
1$name=(isset($_POST['name'])?$_POST['name']:'');
2$age=$_POST['age'];
3 if(isset($age)&&preg_match('/[a-zA-Z]+/',$name)&&is_int($age))
4 echo'<inputtype=\"hidden\"name=\"user\"value=\":$name.\">';
5 else
6 echo$name.\"isaninvaliduser\";
7?>
```  
**SQL (SQL injection)** happens when someone tries to change a SQL query before passing it to the backend database server. An attacker can exploit it to read or write personal data from the backend database without permission or execute the system command on the database server in some conditions. The example code Listing 2 uses _$id_ to render the SQL query dynamically in code line 2. A well-skilled attacker can execute SQL injection by supplying an evil-formatted string in the input variable _$_GET[\"id\"]_, which may be in the form of _\"UNION [evil SQL query]\"_. Then, the database structure and personal data will be leaked and modified by posting malicious SQL queries.  
```
0<?php
1 functionboo(){
2$id=$_GET[\"id\"];
3 if(isset($id)){
4$sql=\"SELECT*FROMusersWHEREid='\".$id.\"\";
5 query($sql);
6}
7}
8?>
```  
**OSCI (OS command injection)** allows an attacker to execute evil commands on the target operating system running the vulnerable web application. The harshness of OSCI depends on the privilege level obtained by the attacker through the injection attack. The example code Listing 3 shows an actual operating system command injection vulnerability, where the _$_GET[\"ip\"]_ input is connected with a string to form a complete shell command. It is designed to check if a host is alive by executing the system command _ping_. However, because of the lack of filtering on the IP address input, anyone can exploit this vulnerability by positioning a malicious IP (such as _\"localhost; [any shell command here]\"_) and running any commands on the target server.  
```
0<?php
1 functionbar(){
2$ip=$_GET[\"ip\"];
3 system('ping'.$ip);
4}
5?>
```