1

For a customized online editor, I would like to automatically detect SQLi or XSS vulnerabilities and provide a convenient way to auto-correct them.

Rather than creating my own scanning/suggestion code, I would like to use an existing utility.

I'm not sure how XSS/SQLi scanners are typically designed, but I would preferably like one that suggests the correct fix, or otherwise identifies the exact location so that I can code in the fix suggester myself.

Is there such a vulnerability scanner for Perl? I assume it would have to de-construct the syntax to identify which variables are plain text, and which ones are HTML; or else the developer would have to indicate this as part of the variable name...

  • Well, there's parsing perl (hard), finding strings which are arguably SQL fragments (can be rather judgemental), and then there's deciding such a string might be subject to cross-site scripting (very difficult). Are you expecting to find a nice package that does all this out of the box? – Ira Baxter Dec 17 '16 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.