There's an extension available for PHP that lets you trace tainted strings. A tainted string is a string that is unsafe, not escaped, can include XSS or SQL injection, and so on. Here's the link:

secure.php.net/manual/en/book.taint.php

I managed to install it using this:

Then you have to edit php.ini:
As an example I tried to view a question in LimeSurvey and got the following error:



The problem was that $qid is never escaped or cast to integer, but shown as-is in the PHP view file. It's easily solved by putting

in the controller.

Just a tip.

False positive ?

sid + gid + qid are always filtered and send 403 if it's not numeric without 0 starting.
github.com/LimeSurvey/LimeSurvey/blob/9b...mmon_Action.php#L148

False positive, no ?