{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.219225Z","repo":{"ref":{"host":"github.com","owner":"WhatCD","name":"Gazelle"},"default_branch":"master","clone_url":"https://github.com/WhatCD/Gazelle.git","html_url":"https://github.com/WhatCD/Gazelle","description":null,"stars":1910,"forks":349,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":29575,"primary_language":"PHP","license_spdx":null,"created_at":"2013-06-30T21:19:23Z","pushed_at":"2016-11-08T08:00:30Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-06-30T20:48:44Z","owner_type":"User","release_assets":[]}},"commit_sha":"63b337026d49b5cf63ce4be20fdabdc880112fa3","profile":{"lines_by_language":{"PHP":85043,"JavaScript":13761,"SQL":1901},"files_by_category":{"source":722,"binary":655,"other":56,"docs":9,"config":2,"vendored":1},"source_lines":100705,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.07},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":48.4,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":55.3,"duplication":40.8,"lint":92.9,"testing":0.0,"docs":100.0,"type_safety":null,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 20% of function code in complex or long functions; 15% duplicated lines. Weakest area: testing."},"security":{"score":45.5,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":0.1,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 1087 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1082.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":190519.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2011-03":{"loc":55844,"attributed_loc":0},"2011-04":{"loc":325,"attributed_loc":0},"2011-05":{"loc":1044,"attributed_loc":0},"2011-06":{"loc":435,"attributed_loc":0},"2011-07":{"loc":577,"attributed_loc":0},"2011-08":{"loc":1072,"attributed_loc":0},"2011-09":{"loc":1484,"attributed_loc":0},"2011-10":{"loc":4186,"attributed_loc":0},"2011-11":{"loc":1477,"attributed_loc":0},"2011-12":{"loc":245,"attributed_loc":0},"2012-01":{"loc":2626,"attributed_loc":0},"2012-02":{"loc":1797,"attributed_loc":0},"2012-03":{"loc":1305,"attributed_loc":0},"2012-04":{"loc":1656,"attributed_loc":0},"2012-05":{"loc":1610,"attributed_loc":0},"2012-06":{"loc":1508,"attributed_loc":0},"2012-07":{"loc":1373,"attributed_loc":0},"2012-08":{"loc":2676,"attributed_loc":0},"2012-09":{"loc":3524,"attributed_loc":0},"2012-10":{"loc":12298,"attributed_loc":0},"2012-11":{"loc":3920,"attributed_loc":0},"2012-12":{"loc":1400,"attributed_loc":0},"2013-01":{"loc":2601,"attributed_loc":0},"2013-02":{"loc":7736,"attributed_loc":0},"2013-03":{"loc":2723,"attributed_loc":0},"2013-04":{"loc":13332,"attributed_loc":0},"2013-05":{"loc":12415,"attributed_loc":0},"2013-06":{"loc":7473,"attributed_loc":0},"2013-07":{"loc":8971,"attributed_loc":0},"2013-08":{"loc":10623,"attributed_loc":0},"2013-09":{"loc":3422,"attributed_loc":0},"2013-10":{"loc":5683,"attributed_loc":0},"2013-11":{"loc":2603,"attributed_loc":0},"2013-12":{"loc":1807,"attributed_loc":0},"2014-01":{"loc":1370,"attributed_loc":0},"2014-02":{"loc":470,"attributed_loc":0},"2014-03":{"loc":2142,"attributed_loc":0},"2014-04":{"loc":408,"attributed_loc":0},"2014-05":{"loc":281,"attributed_loc":0},"2014-06":{"loc":149,"attributed_loc":0},"2014-07":{"loc":27,"attributed_loc":0},"2014-08":{"loc":22,"attributed_loc":0},"2014-09":{"loc":31,"attributed_loc":0},"2015-01":{"loc":1422,"attributed_loc":0},"2015-02":{"loc":51,"attributed_loc":0},"2015-03":{"loc":22,"attributed_loc":0},"2015-04":{"loc":28,"attributed_loc":0},"2015-07":{"loc":4,"attributed_loc":0},"2015-08":{"loc":56,"attributed_loc":0},"2015-09":{"loc":14,"attributed_loc":0},"2015-10":{"loc":464,"attributed_loc":0},"2015-11":{"loc":74,"attributed_loc":0},"2015-12":{"loc":101,"attributed_loc":0},"2016-01":{"loc":195,"attributed_loc":0},"2016-02":{"loc":298,"attributed_loc":0},"2016-03":{"loc":1027,"attributed_loc":0},"2016-04":{"loc":43,"attributed_loc":0},"2016-05":{"loc":9,"attributed_loc":0},"2016-07":{"loc":1,"attributed_loc":0},"2016-08":{"loc":1,"attributed_loc":0},"2016-10":{"loc":34,"attributed_loc":0},"2016-11":{"loc":4,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":887.0,"flagged_units":0.0,"pre_ai_era_bursts":4.0,"pre_ai_era_measured_loc":112288.0,"pre_ai_era_burst_loc":9853.0,"measured_loc":112288.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":798.75,"median_loc_per_hour":63.75,"pr_timed_units":0.0,"excluded_import_loc":74437.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["3e3fdfb804b3faea02df1c0a40ed2cba3b5f3663","ac74044ec272101a730c5735b76b5ec8f5df9ca5","e830d8d5178b4491aa9f608f274674d7c8d51dea","ff67a811d4dfbb34c9249e40d73f9a00930423e9"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":100705.0,"index":0.07,"count:narrated_steps":7.0,"per_kloc:narrated_steps":0.07,"files:narrated_steps":5.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Now we pick if it should go on the top or bottom","ref":"classes/artists_similar.class.php:229","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/artists_similar.class.php#L229","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // now let's POST it to mailgun","ref":"classes/misc.class.php:41","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/misc.class.php#L41","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: * First, construct the archive:","ref":"classes/zip.class.php:20","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/zip.class.php#L20","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: * Then, add files and begin streaming to the user to avoid memory buffering:","ref":"classes/zip.class.php:33","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/zip.class.php#L33","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: * Then, close the archive to the user:","ref":"classes/zip.class.php:45","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/zip.class.php#L45","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: //Now we're dealing with a normal post","ref":"sections/forums/take_reply.php:123","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/sections/forums/take_reply.php#L123","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Now we've done everything, update the DB with values","ref":"sections/reportsv2/takeresolve.php:329","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/sections/reportsv2/takeresolve.php#L329","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1556.0,"findings_high":1087.0,"findings_medium":468.0,"findings_low":1.0,"weighted_findings":1918.262,"scanned_lines":98804.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/bencodetorrent.class.php","line":118,"fingerprint":"php.lang.security.weak-crypto:classes/bencodetorrent.class.php:118"},{"rule_id":"opengrep/php.lang.security.mcrypt-use","severity":"high","message":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low]","path":"classes/encrypt.class.php","line":18,"fingerprint":"php.lang.security.mcrypt-use:classes/encrypt.class.php:18"},{"rule_id":"opengrep/php.lang.security.mcrypt-use","severity":"high","message":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low]","path":"classes/encrypt.class.php","line":19,"fingerprint":"php.lang.security.mcrypt-use:classes/encrypt.class.php:19"},{"rule_id":"opengrep/php.lang.security.mcrypt-use","severity":"high","message":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low]","path":"classes/encrypt.class.php","line":20,"fingerprint":"php.lang.security.mcrypt-use:classes/encrypt.class.php:20"},{"rule_id":"opengrep/php.lang.security.mcrypt-use","severity":"high","message":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low]","path":"classes/encrypt.class.php","line":28,"fingerprint":"php.lang.security.mcrypt-use:classes/encrypt.class.php:28"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"classes/format.class.php","line":398,"fingerprint":"php.lang.security.injection.echoed-request:classes/format.class.php:398"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/script_start.php","line":177,"fingerprint":"php.lang.security.weak-crypto:classes/script_start.php:177"},{"rule_id":"opengrep/php.lang.security.backticks-use","severity":"high","message":"Backticks use may lead to command injection vulnerabilities. [confidence low]","path":"classes/tools.class.php","line":95,"fingerprint":"php.lang.security.backticks-use:classes/tools.class.php:95"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"classes/tools.class.php","line":133,"fingerprint":"php.lang.security.exec-use:classes/tools.class.php:133"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/users.class.php","line":377,"fingerprint":"php.lang.security.weak-crypto:classes/users.class.php:377"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/users.class.php","line":394,"fingerprint":"php.lang.security.weak-crypto:classes/users.class.php:394"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/users.class.php","line":420,"fingerprint":"php.lang.security.weak-crypto:classes/users.class.php:420"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/users.class.php","line":696,"fingerprint":"php.lang.security.weak-crypto:classes/users.class.php:696"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"classes/users.class.php","line":698,"fingerprint":"php.lang.security.weak-crypto:classes/users.class.php:698"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"opensearch.php","line":18,"fingerprint":"php.lang.security.injection.echoed-request:opensearch.php:18"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"opensearch.php","line":19,"fingerprint":"php.lang.security.injection.echoed-request:opensearch.php:19"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"opensearch.php","line":68,"fingerprint":"php.lang.security.injection.echoed-request:opensearch.php:68"},{"rule_id":"opengrep/php.lang.security.extract-user-data","severity":"high","message":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium]","path":"sections/ajax/artist.php","line":181,"fingerprint":"php.lang.security.extract-user-data:sections/ajax/artist.php:181"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/bookmarks/torrents.php","line":79,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/bookmarks/torrents.php:79"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/forum/forum.php","line":93,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/forum/forum.php:93"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/forum/forum.php","line":165,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/forum/forum.php:165"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/forum/thread.php","line":273,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/forum/thread.php:273"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/inbox/viewconv.php","line":93,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/inbox/viewconv.php:93"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/preview.php","line":5,"fingerprint":"php.lang.security.injection.echoed-request:sections/ajax/preview.php:5"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/preview.php","line":8,"fingerprint":"php.lang.security.injection.echoed-request:sections/ajax/preview.php:8"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/top10/tags.php","line":83,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/top10/tags.php:83"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"sections/ajax/top10/torrents.php","line":130,"fingerprint":"php.lang.security.injection.tainted-sql-string:sections/ajax/top10/torrents.php:130"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/top10/torrents.php","line":140,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/top10/torrents.php:140"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/ajax/top10/users.php","line":98,"fingerprint":"php.lang.security.injection.printed-request:sections/ajax/top10/users.php:98"},{"rule_id":"opengrep/php.lang.security.extract-user-data","severity":"high","message":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium]","path":"sections/ajax/userhistory/post_history.php","line":32,"fingerprint":"php.lang.security.extract-user-data:sections/ajax/userhistory/post_history.php:32"},{"rule_id":"opengrep/php.lang.security.file-inclusion","severity":"high","message":"Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]","path":"sections/api/index.php","line":70,"fingerprint":"php.lang.security.file-inclusion:sections/api/index.php:70"},{"rule_id":"opengrep/php.lang.security.extract-user-data","severity":"high","message":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium]","path":"sections/artist/artist.php","line":285,"fingerprint":"php.lang.security.extract-user-data:sections/artist/artist.php:285"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":328,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:328"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":331,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:331"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":331,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:331"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":387,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:387"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":389,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:389"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":390,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:390"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":400,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:400"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":403,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:403"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":403,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:403"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":407,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:407"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":407,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:407"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":413,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:413"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":444,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:444"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":444,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:444"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":445,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:445"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":445,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:445"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":455,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:455"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":455,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:455"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":463,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:463"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":490,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:490"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":490,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:490"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":493,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:493"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":510,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:510"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":512,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:512"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":519,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:519"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":519,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:519"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":521,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:521"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":521,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:521"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":523,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:523"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":523,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:523"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":528,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:528"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":530,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:530"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":532,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:532"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":532,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:532"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":534,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:534"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":536,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:536"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":538,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:538"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":540,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:540"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":548,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:548"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":550,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:550"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":550,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:550"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":550,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:550"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":560,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:560"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":585,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:585"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":643,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:643"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":645,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:645"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":646,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:646"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":647,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:647"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:692"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:692"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:692"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":694,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:694"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":694,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:694"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":695,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:695"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":695,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:695"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":697,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:697"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":712,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:712"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":751,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:751"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":760,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:760"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":760,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:760"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":761,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:761"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":769,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:769"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":769,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:769"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":770,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:770"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":824,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:824"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":825,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:825"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":828,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:828"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":828,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:828"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":831,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:831"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":835,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:835"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":835,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:835"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":838,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:838"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":878,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:878"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":950,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:950"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":963,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:963"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/artist.php","line":971,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/artist.php:971"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/autocomplete.php","line":50,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/autocomplete.php:50"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":183,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:183"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":184,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:184"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/change_artistid.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/change_artistid.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/delete.php","line":38,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/delete.php:38"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/delete.php","line":66,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/delete.php:66"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/edit.php","line":40,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/edit.php:40"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/edit.php","line":46,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/edit.php:46"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/edit.php","line":69,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/edit.php:69"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/edit.php","line":84,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/edit.php:84"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/edit.php","line":141,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/edit.php:141"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/artist/history.php","line":20,"fingerprint":"php.lang.security.injection.echoed-request:sections/artist/history.php:20"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/better/transcode.php","line":92,"fingerprint":"php.lang.security.injection.echoed-request:sections/better/transcode.php:92"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/better/transcode.php","line":93,"fingerprint":"php.lang.security.injection.echoed-request:sections/better/transcode.php:93"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/better/transcode_beta.php","line":258,"fingerprint":"php.lang.security.injection.echoed-request:sections/better/transcode_beta.php:258"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/blog/index.php","line":119,"fingerprint":"php.lang.security.injection.echoed-request:sections/blog/index.php:119"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/blog/index.php","line":122,"fingerprint":"php.lang.security.injection.echoed-request:sections/blog/index.php:122"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/blog/index.php","line":124,"fingerprint":"php.lang.security.injection.echoed-request:sections/blog/index.php:124"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/blog/index.php","line":127,"fingerprint":"php.lang.security.injection.echoed-request:sections/blog/index.php:127"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"sections/bookmarks/add.php","line":104,"fingerprint":"php.lang.security.injection.tainted-sql-string:sections/bookmarks/add.php:104"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"sections/bookmarks/remove.php","line":36,"fingerprint":"php.lang.security.injection.tainted-sql-string:sections/bookmarks/remove.php:36"},{"rule_id":"opengrep/php.lang.security.extract-user-data","severity":"high","message":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium]","path":"sections/bookmarks/torrents.php","line":45,"fingerprint":"php.lang.security.extract-user-data:sections/bookmarks/torrents.php:45"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":87,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:87"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":89,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:89"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":90,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:90"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":97,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:97"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":103,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:103"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":135,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:135"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":136,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:136"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":136,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:136"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":146,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:146"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":154,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:154"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":182,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:182"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":196,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:196"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":199,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:199"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":199,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:199"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":201,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:201"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":232,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:232"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":233,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:233"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/bookmarks/torrents.php","line":233,"fingerprint":"php.lang.security.injection.echoed-request:sections/bookmarks/torrents.php:233"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/all_comments.php","line":34,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/all_comments.php:34"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/all_comments.php","line":37,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/all_comments.php:37"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/all_comments.php","line":37,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/all_comments.php:37"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/all_comments.php","line":41,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/all_comments.php:41"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/all_comments.php","line":64,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/all_comments.php:64"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/browse.php","line":170,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/browse.php:170"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/browse.php","line":181,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/browse.php:181"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/browse.php","line":187,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/browse.php:187"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/delete.php","line":29,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/delete.php:29"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/edit.php","line":32,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/edit.php:32"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/edit.php","line":37,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/edit.php:37"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage.php","line":46,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage.php:46"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage.php","line":123,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage.php:123"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage.php","line":140,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage.php:140"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage_artists.php","line":41,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage_artists.php:41"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage_artists.php","line":89,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage_artists.php:89"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/collages/manage_artists.php","line":106,"fingerprint":"php.lang.security.injection.echoed-request:sections/collages/manage_artists.php:106"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/comments/comments.php","line":234,"fingerprint":"php.lang.security.injection.echoed-request:sections/comments/comments.php:234"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/comments/comments.php","line":237,"fingerprint":"php.lang.security.injection.echoed-request:sections/comments/comments.php:237"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/comments/take_edit.php","line":16,"fingerprint":"php.lang.security.injection.echoed-request:sections/comments/take_edit.php:16"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/comments/warn.php","line":27,"fingerprint":"php.lang.security.injection.echoed-request:sections/comments/warn.php:27"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/enable/index.php","line":14,"fingerprint":"php.lang.security.injection.echoed-request:sections/enable/index.php:14"},{"rule_id":"opengrep/php.lang.security.file-inclusion","severity":"high","message":"Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]","path":"sections/error/index.php","line":12,"fingerprint":"php.lang.security.file-inclusion:sections/error/index.php:12"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":61,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:61"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":66,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:66"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":66,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:66"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":66,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:66"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":66,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:66"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":68,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:68"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":68,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:68"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":74,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:74"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":74,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:74"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":74,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:74"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/ajax_get_edit.php","line":74,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/ajax_get_edit.php:74"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/edit_rules.php","line":48,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/edit_rules.php:48"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/edit_rules.php","line":48,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/edit_rules.php:48"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":86,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:86"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":89,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:89"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":133,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:133"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":146,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:146"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":146,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:146"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":153,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:153"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":250,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:250"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":250,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:250"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":250,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:250"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":252,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:252"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":256,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:256"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":256,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:256"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":256,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:256"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":260,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:260"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":260,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:260"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":263,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:263"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":264,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:264"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":270,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:270"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":273,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:273"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/forum.php","line":275,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/forum.php:275"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/newthread.php","line":28,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/newthread.php:28"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/newthread.php","line":28,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/newthread.php:28"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/newthread.php","line":83,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/newthread.php:83"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":91,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:91"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":92,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:92"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":95,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:95"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":140,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:140"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":140,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:140"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":143,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:143"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":162,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:162"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":162,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:162"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/poll_vote.php","line":168,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/poll_vote.php:168"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":92,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:92"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":106,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:106"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":113,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:113"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":115,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:115"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":134,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:134"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":136,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:136"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/search.php","line":196,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/search.php:196"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/takeedit.php","line":127,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/takeedit.php:127"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/thread.php","line":210,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/thread.php:210"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/warn.php","line":21,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/warn.php:21"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/warn.php","line":21,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/warn.php:21"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/warn.php","line":25,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/warn.php:25"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/warn.php","line":26,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/warn.php:26"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/forums/warn.php","line":27,"fingerprint":"php.lang.security.injection.echoed-request:sections/forums/warn.php:27"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload isset($_GET['i']) ? htmlspecialchars_d [confidence low]","path":"sections/image/index.php","line":6,"fingerprint":"php.lang.security.php-ssrf:sections/image/index.php:6"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload isset($_GET['i']) ? htmlspecialchars_d [confidence low]","path":"sections/image/index.php","line":6,"fingerprint":"php.lang.security.php-ssrf:sections/image/index.php:6"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"sections/image/index.php","line":17,"fingerprint":"php.lang.security.weak-crypto:sections/image/index.php:17"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"sections/image/index.php","line":38,"fingerprint":"php.lang.security.weak-crypto:sections/image/index.php:38"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/image/index.php","line":134,"fingerprint":"php.lang.security.injection.echoed-request:sections/image/index.php:134"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/compose.php","line":31,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/compose.php:31"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/compose.php","line":36,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/compose.php:36"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/conversation.php","line":116,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/conversation.php:116"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/conversation.php","line":132,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/conversation.php:132"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/conversation.php","line":169,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/conversation.php:169"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/inbox.php","line":93,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/inbox.php:93"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/inbox/inbox.php","line":109,"fingerprint":"php.lang.security.injection.echoed-request:sections/inbox/inbox.php:109"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/log/index.php","line":20,"fingerprint":"php.lang.security.injection.echoed-request:sections/log/index.php:20"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/login/disabled.php","line":83,"fingerprint":"php.lang.security.injection.echoed-request:sections/login/disabled.php:83"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/login/disabled.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/login/disabled.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/login/recover_step2.php","line":8,"fingerprint":"php.lang.security.injection.echoed-request:sections/login/recover_step2.php:8"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/answer_question.php","line":44,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/answer_question.php:44"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/edit.php","line":40,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/edit.php:40"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/edit.php","line":41,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/edit.php:41"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/view_answers.php","line":40,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/view_answers.php:40"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/view_answers.php","line":55,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/view_answers.php:55"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/view_answers.php","line":60,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/view_answers.php:60"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/questions/view_answers.php","line":76,"fingerprint":"php.lang.security.injection.echoed-request:sections/questions/view_answers.php:76"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/register/step1.php","line":14,"fingerprint":"php.lang.security.injection.echoed-request:sections/register/step1.php:14"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/register/step1.php","line":24,"fingerprint":"php.lang.security.injection.echoed-request:sections/register/step1.php:24"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/register/step1.php","line":31,"fingerprint":"php.lang.security.injection.echoed-request:sections/register/step1.php:31"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"sections/reports/ajax_unclaim_report.php","line":13,"fingerprint":"php.lang.security.injection.tainted-sql-string:sections/reports/ajax_unclaim_report.php:13"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/compose.php","line":154,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/compose.php:154"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/compose.php","line":160,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/compose.php:160"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/compose.php","line":164,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/compose.php:164"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/compose.php","line":167,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/compose.php:167"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":132,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:132"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":139,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:139"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":174,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:174"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":175,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:175"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":272,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:272"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":293,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:293"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reports/report.php","line":294,"fingerprint":"php.lang.security.injection.echoed-request:sections/reports/report.php:294"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_change_resolve.php","line":42,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_change_resolve.php:42"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":25,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:25"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":40,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:40"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":52,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:52"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":64,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:64"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":76,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:76"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":89,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:89"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/ajax_report.php","line":100,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/ajax_report.php:100"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":78,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:78"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":99,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:99"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":141,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:141"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":142,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:142"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":143,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:143"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":144,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:144"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/report.php","line":145,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/report.php:145"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":62,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/takeresolve.php:62"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":62,"fingerprint":"php.lang.security.injection.tainted-sql-string:sections/reportsv2/takeresolve.php:62"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":96,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/takeresolve.php:96"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":97,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/takeresolve.php:97"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":342,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/takeresolve.php:342"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/reportsv2/takeresolve.php","line":343,"fingerprint":"php.lang.security.injection.echoed-request:sections/reportsv2/takeresolve.php:343"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/requests/interim.php","line":32,"fingerprint":"php.lang.security.injection.echoed-request:sections/requests/interim.php:32"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/requests/interim.php","line":36,"fingerprint":"php.lang.security.injection.echoed-request:sections/requests/interim.php:36"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"sections/requests/interim.php","line":38,"fingerprint":"php.lang.security.injection.echoed-request:sections/requests/interim.php:38"}],"evidence":[],"data":{"rulesets":["php","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2488.0,"function_nloc":28789.0,"mean_ccn":3.69,"p90_ccn":8.0,"complex_functions":74.0,"long_functions":22.0,"many_param_functions":7.0,"risky_nloc_share":0.1974},"findings":[],"evidence":[{"kind":"complex-function","description":"TORRENT_FORM::music_form in classes/torrent_form.class.php: complexity 88, 465 lines","ref":"classes/torrent_form.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/torrent_form.class.php#L167","weight":1.0},{"kind":"complex-function","description":"Text::to_html in classes/text.class.php: complexity 68, 232 lines","ref":"classes/text.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/text.class.php#L599","weight":1.0},{"kind":"complex-function","description":"build_torrents_table in sections/torrents/functions.php: complexity 65, 252 lines","ref":"sections/torrents/functions.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/sections/torrents/functions.php#L252","weight":1.0},{"kind":"complex-function","description":"Text::parse in classes/text.class.php: complexity 58, 196 lines","ref":"classes/text.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/text.class.php#L278","weight":0.9666666666666667},{"kind":"complex-function","description":"positionTooltip in static/functions/tooltipster.js: complexity 52, 1 lines","ref":"static/functions/tooltipster.js","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/static/functions/tooltipster.js#L1","weight":0.8666666666666667},{"kind":"complex-function","description":"VALIDATE::ValidateForm in classes/validate.class.php: complexity 46, 120 lines","ref":"classes/validate.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/validate.class.php#L38","weight":0.7666666666666667},{"kind":"complex-function","description":"Users::format_username in classes/users.class.php: complexity 37, 102 lines","ref":"classes/users.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/users.class.php#L461","weight":0.6166666666666667},{"kind":"complex-function","description":"Artists::display_artists in classes/artists.class.php: complexity 36, 75 lines","ref":"classes/artists.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/artists.class.php#L95","weight":0.6},{"kind":"complex-function","description":"(anonymous) in static/functions/tagcanvas.js: complexity 34, 1 lines","ref":"static/functions/tagcanvas.js","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/static/functions/tagcanvas.js#L21","weight":0.5666666666666667},{"kind":"complex-function","description":"time_diff in classes/time.class.php: complexity 33, 107 lines","ref":"classes/time.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/time.class.php#L23","weight":0.55}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":77301.0,"duplicated_lines":11542.0,"duplicated_share":0.1493,"files":722.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: api.php:47 and classes/ajax_start.php:41","ref":"api.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/api.php#L47","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api.php:57 and feeds.php:36","ref":"api.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/api.php#L57","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api.php:58 and classes/util.php:105","ref":"api.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/api.php#L58","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/cache.class.php:247 and classes/cache.class.php:283","ref":"classes/cache.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/cache.class.php#L247","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/charts.class.php:76 and classes/charts.class.php:149","ref":"classes/charts.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/charts.class.php#L76","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/commentsview.class.php:34 and design/views/generic/reply/quickreply.php:78","ref":"classes/commentsview.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/commentsview.class.php#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/commentsview.class.php:74 and sections/userhistory/post_history.php:264","ref":"classes/commentsview.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/commentsview.class.php#L74","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/forums.class.php:18 and sections/forums/poll_vote.php:16","ref":"classes/forums.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/forums.class.php#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/forums.class.php:43 and sections/forums/thread.php:96","ref":"classes/forums.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/forums.class.php#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: classes/forums.class.php:243 and sections/ajax/forum/forum.php:110","ref":"classes/forums.class.php","url":"https://github.com/WhatCD/Gazelle/blob/63b337026d49b5cf63ce4be20fdabdc880112fa3/classes/forums.class.php#L243","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":35.0,"weighted_findings":29.0,"scanned_lines":98804.0,"category:best-practice":27.0,"category:correctness":8.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/comments.js","line":161,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/comments.js:161"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/comments.js","line":204,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/comments.js:204"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/detect_mobile.js","line":34,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/detect_mobile.js:34"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/detect_mobile.js","line":42,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/detect_mobile.js:42"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/enable_requests.js","line":32,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/enable_requests.js:32"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/enable_requests.js","line":61,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/enable_requests.js:61"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/enable_requests.js","line":79,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/enable_requests.js:79"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/enable_requests.js","line":81,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/enable_requests.js:81"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/jquery.tablesorter.js","line":146,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/jquery.tablesorter.js:146"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/musicbrainz.js","line":49,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/musicbrainz.js:49"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/musicbrainz.js","line":112,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/musicbrainz.js:112"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reports.js","line":19,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reports.js:19"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reports.js","line":31,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reports.js:31"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reports.js","line":34,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reports.js:34"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/reports.js","line":59,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/reports.js:59"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reports.js","line":72,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reports.js:72"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":122,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:122"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":131,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:131"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":139,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:139"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":167,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:167"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":177,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:177"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/reportsv2.js","line":216,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/reportsv2.js:216"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/requests.js","line":26,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/requests.js:26"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/torrent.js","line":191,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/torrent.js:191"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"static/functions/user.js","line":164,"fingerprint":"javascript.lang.best-practice.javascript-confirm:static/functions/user.js:164"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/validate.js","line":96,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/validate.js:96"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"static/functions/validate_upload.js","line":22,"fingerprint":"javascript.lang.best-practice.javascript-alert:static/functions/validate_upload.js:22"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`l` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`h` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`e` is assigned twice; the first assignment is useless","path":"static/functions/jquery-ui.js","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/jquery-ui.js:6"},{"rule_id":"opengrep/javascript.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected a useless comparison operation `expanded == expanded` or `expanded != expanded`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.","path":"static/functions/lastfm.js","line":48,"fingerprint":"javascript.lang.correctness.eqeq-is-bad:static/functions/lastfm.js:48"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`ai` is assigned twice; the first assignment is useless","path":"static/functions/tagcanvas.js","line":21,"fingerprint":"javascript.lang.correctness.useless-assignment:static/functions/tagcanvas.js:21"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":100705.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":289.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":23.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"docs/COPYING.txt","ref":"docs/COPYING.txt","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"docs/CHANGES.txt","ref":"docs/CHANGES.txt","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}