RepoTrust

Leaderboard github.com

WhatCD/Gazelle

  • View repository ↗
  • PHP
  • ★ 1,910
  • commit 63b337026d49
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

none-detected

Confidence
65%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

48/100

poor

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

46/100

poor

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.07

Lines added per month all AI-attributed share

  1. 2011-0355,844 · 0% AI
  2. 2011-04325 · 0% AI
  3. 2011-051,044 · 0% AI
  4. 2011-06435 · 0% AI
  5. 2011-07577 · 0% AI
  6. 2011-081,072 · 0% AI
  7. 2011-091,484 · 0% AI
  8. 2011-104,186 · 0% AI
  9. 2011-111,477 · 0% AI
  10. 2011-12245 · 0% AI
  11. 2012-012,626 · 0% AI
  12. 2012-021,797 · 0% AI
  13. 2012-031,305 · 0% AI
  14. 2012-041,656 · 0% AI
  15. 2012-051,610 · 0% AI
  16. 2012-061,508 · 0% AI
  17. 2012-071,373 · 0% AI
  18. 2012-082,676 · 0% AI
  19. 2012-093,524 · 0% AI
  20. 2012-1012,298 · 0% AI
  21. 2012-113,920 · 0% AI
  22. 2012-121,400 · 0% AI
  23. 2013-012,601 · 0% AI
  24. 2013-027,736 · 0% AI
  25. 2013-032,723 · 0% AI
  26. 2013-0413,332 · 0% AI
  27. 2013-0512,415 · 0% AI
  28. 2013-067,473 · 0% AI
  29. 2013-078,971 · 0% AI
  30. 2013-0810,623 · 0% AI
  31. 2013-093,422 · 0% AI
  32. 2013-105,683 · 0% AI
  33. 2013-112,603 · 0% AI
  34. 2013-121,807 · 0% AI
  35. 2014-011,370 · 0% AI
  36. 2014-02470 · 0% AI
  37. 2014-032,142 · 0% AI
  38. 2014-04408 · 0% AI
  39. 2014-05281 · 0% AI
  40. 2014-06149 · 0% AI
  41. 2014-0727 · 0% AI
  42. 2014-0822 · 0% AI
  43. 2014-0931 · 0% AI
  44. 2015-011,422 · 0% AI
  45. 2015-0251 · 0% AI
  46. 2015-0322 · 0% AI
  47. 2015-0428 · 0% AI
  48. 2015-074 · 0% AI
  49. 2015-0856 · 0% AI
  50. 2015-0914 · 0% AI
  51. 2015-10464 · 0% AI
  52. 2015-1174 · 0% AI
  53. 2015-12101 · 0% AI
  54. 2016-01195 · 0% AI
  55. 2016-02298 · 0% AI
  56. 2016-031,027 · 0% AI
  57. 2016-0443 · 0% AI
  58. 2016-059 · 0% AI
  59. 2016-071 · 0% AI
  60. 2016-081 · 0% AI
  61. 2016-1034 · 0% AI
  62. 2016-114 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
1,082
effective_loc
190,519
tools_detected
0
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
74,437
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
798.75
measured_loc
112,288
median_loc_per_hour
63.75
pr_timed_units
0
pre_ai_era_burst_loc
9,853
pre_ai_era_bursts
4
pre_ai_era_measured_loc
112,288
work_units
887
Release velocityskipped
Coding styleok7 items
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
7
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
5
files:placeholder
0
index
0.07
lines_scanned
100,705
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0.07
per_kloc:placeholder
0

Code quality

48 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 20% of function code in complex or long functions; 15% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity55
  • Duplication41
  • Lint and smells93
  • Tests and CI0
  • Documentation100
  • Type safetynot measured
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items
complex_functions
74
function_nloc
28,789
functions
2,488
long_functions
22
many_param_functions
7
mean_ccn
3.69
p90_ccn
8
risky_nloc_share
19.7%
Duplication (jscpd)ok10 items
compared_lines
77,301
duplicated_lines
11,542
duplicated_share
14.9%
files
722
Lintok
category:best-practice
27
category:correctness
8
findings
35
scanned_lines
98,804
weighted_findings
29
Tests and CIok
check:ci_present
no
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
0
cochange_commits
289
cochange_share
0.0%
source_lines
100,705
test_lines
0
test_ratio
0
Documentationok4 items
  • README.md README.md
  • docs/COPYING.txt docs/COPYING.txt
  • CONTRIBUTING.md CONTRIBUTING.md
  • docs/CHANGES.txt docs/CHANGES.txt
check:changelog
yes
check:contributing
yes
check:license
yes
check:readme
yes
readme_lines
23
Type safetyskipped

Security

46 poor

Security posture is poor: 1087 high-severity SAST findings. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)0
  • Vulnerable dependenciesnot measured
  • CI workflowsnot measured
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
1,556
findings_high
1,087
findings_low
1
findings_medium
468
parse_errors
2
scanned_lines
98,804
weighted_findings
1,918.26
Dependencies (osv-scanner)skipped
CI workflows (zizmor)skipped
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
0.0%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

300 high27 medium8 low

SeverityRuleLocationMessageTool
high opengrep/php.lang.security.weak-crypto classes/bencodetorrent.class.php:118 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.mcrypt-use classes/encrypt.class.php:18 Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.mcrypt-use classes/encrypt.class.php:19 Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.mcrypt-use classes/encrypt.class.php:20 Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.mcrypt-use classes/encrypt.class.php:28 Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request classes/format.class.php:398 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/script_start.php:177 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.exec-use classes/tools.class.php:133 Executing non-constant commands. This can lead to command injection. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.backticks-use classes/tools.class.php:95 Backticks use may lead to command injection vulnerabilities. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/users.class.php:377 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/users.class.php:394 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/users.class.php:420 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/users.class.php:696 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto classes/users.class.php:698 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request opensearch.php:18 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request opensearch.php:19 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request opensearch.php:68 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.extract-user-data sections/ajax/artist.php:181 Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/bookmarks/torrents.php:79 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/forum/forum.php:165 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/forum/forum.php:93 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/forum/thread.php:273 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/inbox/viewconv.php:93 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/ajax/preview.php:5 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/ajax/preview.php:8 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/top10/tags.php:83 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.tainted-sql-string sections/ajax/top10/torrents.php:130 User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL... Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/top10/torrents.php:140 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.printed-request sections/ajax/top10/users.php:98 `Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.extract-user-data sections/ajax/userhistory/post_history.php:32 Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.file-inclusion sections/api/index.php:70 Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead,... Static analysis (opengrep)
high opengrep/php.lang.security.extract-user-data sections/artist/artist.php:285 Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:328 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:331 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:331 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:387 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:389 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:390 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:400 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:403 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:403 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:407 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:407 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:413 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:444 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:444 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:445 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:445 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:455 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:455 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:463 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:490 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:490 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:493 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:510 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:512 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:519 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:519 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:521 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:521 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:523 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:523 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:528 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:530 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:532 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:532 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:534 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:536 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:538 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:540 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:548 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:550 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:550 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:550 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:560 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:585 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:643 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:645 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:646 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:647 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:692 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:692 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:692 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:694 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:694 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:695 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:695 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:697 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:712 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:751 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:760 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:760 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:761 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:769 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:769 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:770 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:824 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:825 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:828 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:828 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:831 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:835 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:835 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:838 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:878 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:950 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:963 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/artist.php:971 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/autocomplete.php:50 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:183 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:184 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/change_artistid.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/delete.php:38 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/delete.php:66 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/edit.php:141 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/edit.php:40 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/edit.php:46 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/edit.php:69 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/edit.php:84 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/artist/history.php:20 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/better/transcode.php:92 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/better/transcode.php:93 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/better/transcode_beta.php:258 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/blog/index.php:119 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/blog/index.php:122 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/blog/index.php:124 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/blog/index.php:127 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.tainted-sql-string sections/bookmarks/add.php:104 User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL... Static analysis (opengrep)
high opengrep/php.lang.security.injection.tainted-sql-string sections/bookmarks/remove.php:36 User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL... Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:103 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:135 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:136 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:136 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:146 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:154 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:182 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:196 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:199 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:199 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:201 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:232 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:233 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:233 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.extract-user-data sections/bookmarks/torrents.php:45 Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:87 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:89 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:90 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/bookmarks/torrents.php:97 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/all_comments.php:34 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/all_comments.php:37 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/all_comments.php:37 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/all_comments.php:41 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/all_comments.php:64 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/browse.php:170 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/browse.php:181 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/browse.php:187 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/delete.php:29 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/edit.php:32 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/edit.php:37 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage.php:123 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage.php:140 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage.php:46 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage_artists.php:106 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage_artists.php:41 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/collages/manage_artists.php:89 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/comments/comments.php:234 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/comments/comments.php:237 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/comments/take_edit.php:16 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/comments/warn.php:27 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/enable/index.php:14 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.file-inclusion sections/error/index.php:12 Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead,... Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:61 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:66 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:66 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:66 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:66 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:68 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:68 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:74 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:74 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:74 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/ajax_get_edit.php:74 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/edit_rules.php:48 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/edit_rules.php:48 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:133 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:146 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:146 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:153 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:250 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:250 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:250 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:252 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:256 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:256 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:256 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:260 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:260 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:263 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:264 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:270 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:273 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:275 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:86 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/forum.php:89 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/newthread.php:28 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/newthread.php:28 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/newthread.php:83 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:140 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:140 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:143 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:162 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:162 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:168 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:91 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:92 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/poll_vote.php:95 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:106 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:113 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:115 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:134 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:136 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:196 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/search.php:92 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/takeedit.php:127 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/thread.php:210 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/warn.php:21 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/warn.php:21 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/warn.php:25 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/warn.php:26 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/forums/warn.php:27 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/image/index.php:134 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto sections/image/index.php:17 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.weak-crypto sections/image/index.php:38 Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] Static analysis (opengrep)
high opengrep/php.lang.security.php-ssrf sections/image/index.php:6 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function... Static analysis (opengrep)
high opengrep/php.lang.security.php-ssrf sections/image/index.php:6 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function... Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/compose.php:31 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/compose.php:36 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/conversation.php:116 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/conversation.php:132 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/conversation.php:169 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/inbox.php:109 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/inbox/inbox.php:93 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/log/index.php:20 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/login/disabled.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/login/disabled.php:83 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/login/recover_step2.php:8 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/answer_question.php:44 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/edit.php:40 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/edit.php:41 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/view_answers.php:40 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/view_answers.php:55 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/view_answers.php:60 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/questions/view_answers.php:76 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/register/step1.php:14 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/register/step1.php:24 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/register/step1.php:31 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.tainted-sql-string sections/reports/ajax_unclaim_report.php:13 User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL... Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/compose.php:154 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/compose.php:160 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/compose.php:164 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/compose.php:167 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:132 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:139 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:174 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:175 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:272 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:293 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reports/report.php:294 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_change_resolve.php:42 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:100 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:25 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:40 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:52 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:64 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:76 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/ajax_report.php:89 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:141 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:142 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:143 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:144 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:145 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:78 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/report.php:99 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/takeresolve.php:342 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/takeresolve.php:343 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/takeresolve.php:62 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.tainted-sql-string sections/reportsv2/takeresolve.php:62 User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL... Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/takeresolve.php:96 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/reportsv2/takeresolve.php:97 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/requests/interim.php:32 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/requests/interim.php:36 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
high opengrep/php.lang.security.injection.echoed-request sections/requests/interim.php:38 `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] Static analysis (opengrep)
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/comments.js:161 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/comments.js:204 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/detect_mobile.js:34 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/detect_mobile.js:42 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/enable_requests.js:32 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/enable_requests.js:61 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/enable_requests.js:79 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/enable_requests.js:81 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/jquery.tablesorter.js:146 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/musicbrainz.js:112 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/musicbrainz.js:49 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reports.js:19 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reports.js:31 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reports.js:34 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/reports.js:59 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reports.js:72 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:122 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:131 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:139 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:167 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:177 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/reportsv2.js:216 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/requests.js:26 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/torrent.js:191 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm static/functions/user.js:164 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/validate.js:96 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert static/functions/validate_upload.js:22 found alert() call; should this be in production code? Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/jquery-ui.js:6 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.eqeq-is-bad static/functions/lastfm.js:48 Detected a useless comparison operation `expanded == expanded` or `expanded != expanded`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. Lint
low opengrep/javascript.lang.correctness.useless-assignment static/functions/tagcanvas.js:21 `ai` is assigned twice; the first assignment is useless Lint

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b41435
Tests and CICode qualityok—0
Type safetyCode qualityskipped—0
CI workflows (zizmor)Securityskipped—0
Dependencies (osv-scanner)Securityskipped—0
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityskipped—0no registry dependencies declared
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b414300
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-1463b337026d49prov-5+qual-2+sec-20%4846
2026-11-1463b337026d49prov-4+qual-2+sec-20%4846

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/WhatCD/Gazelle/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/WhatCD/Gazelle/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/WhatCD/Gazelle/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/WhatCD/Gazelle/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/WhatCD/Gazelle/security.svg)](https://repotrust.synapticcyber.com/r/github.com/WhatCD/Gazelle/)
Full text report
  • Repository: https://github.com/WhatCD/Gazelle
  • Commit: 63b337026d49b5cf63ce4be20fdabdc880112fa3
  • Generated: 2026-11-14T14:52:02+00:00
  • Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 none-detected 65% 100%
Code quality 48 poor 90% 100%
Security 46 poor 85% 100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

  • Explicitly attributed share (lower bound): 0.0%

  • Unattributed share in AI-consistent velocity bursts: 0.0%

  • Estimated AI-generated share: 0.0%

  • Stylometry index: 0.07 per 1,000 lines (narrated steps 7, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Month Lines added Attributed to AI
2015-10 464 0%
2015-11 74 0%
2015-12 101 0%
2016-01 195 0%
2016-02 298 0%
2016-03 1,027 0%
2016-04 43 0%
2016-05 9 0%
2016-07 1 0%
2016-08 1 0%
2016-10 34 0%
2016-11 4 0%

Evidence

  • step-by-step narration comment: // Now we pick if it should go on the top or bottom (classes/arti)
  • step-by-step narration comment: // now let's POST it to mailgun (classes/misc)
  • step-by-step narration comment: * First, construct the archive: (classes/zip.)
  • step-by-step narration comment: * Then, add files and begin streaming to the user to avoid memory buffering: (classes/zip.)
  • step-by-step narration comment: * Then, close the archive to the user: (classes/zip.)
  • step-by-step narration comment: //Now we're dealing with a normal post (sections/for)
  • step-by-step narration comment: // Now we've done everything, update the DB with values (sections/rep)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 20% of function code in complex or long functions; 15% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 55
Duplication 41
Code smells (Opengrep) 93
Tests and CI 0
Documentation 100
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 2,488; mean complexity 3.7, 90th percentile 8; 74 complex and 22 long functions
  • Duplicated lines: 14.9% of 77,301 compared
  • Tests: 0 test lines for 100,705 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: none

Most complex functions:

Security

Security posture is poor: 1087 high-severity SAST findings. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 0
Vulnerable dependencies (OSV) n/a
CI workflows (zizmor) n/a
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/bencodetorrent.class.php:118
high opengrep/php.lang.security.mcrypt-use: Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] classes/encrypt.class.php:18
high opengrep/php.lang.security.mcrypt-use: Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] classes/encrypt.class.php:19
high opengrep/php.lang.security.mcrypt-use: Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] classes/encrypt.class.php:20
high opengrep/php.lang.security.mcrypt-use: Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low] classes/encrypt.class.php:28
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] classes/format.class.php:398
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/script_start.php:177
high opengrep/php.lang.security.backticks-use: Backticks use may lead to command injection vulnerabilities. [confidence low] classes/tools.class.php:95
high opengrep/php.lang.security.exec-use: Executing non-constant commands. This can lead to command injection. [confidence low] classes/tools.class.php:133
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/users.class.php:377
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/users.class.php:394
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/users.class.php:420
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/users.class.php:696
high opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] classes/users.class.php:698
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] opensearch.php:18
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] opensearch.php:19
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] opensearch.php:68
high opengrep/php.lang.security.extract-user-data: Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. [confidence medium] sections/ajax/artist.php:181
high opengrep/php.lang.security.injection.printed-request: Printing user input risks cross-site scripting vulnerability. You should use htmlentities()` when showing data to users. [confidence medium] sections/ajax/bookmarks/torrents.php:79
high opengrep/php.lang.security.injection.printed-request: Printing user input risks cross-site scripting vulnerability. You should use htmlentities()` when showing data to users. [confidence medium] sections/ajax/forum/forum.php:93
high opengrep/php.lang.security.injection.printed-request: Printing user input risks cross-site scripting vulnerability. You should use htmlentities()` when showing data to users. [confidence medium] sections/ajax/forum/forum.php:165
high opengrep/php.lang.security.injection.printed-request: Printing user input risks cross-site scripting vulnerability. You should use htmlentities()` when showing data to users. [confidence medium] sections/ajax/forum/thread.php:273
high opengrep/php.lang.security.injection.printed-request: Printing user input risks cross-site scripting vulnerability. You should use htmlentities()` when showing data to users. [confidence medium] sections/ajax/inbox/viewconv.php:93
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] sections/ajax/preview.php:5
high opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] sections/ajax/preview.php:8

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 100,705; test lines: 0
Language Lines
PHP 85,043
JavaScript 13,761
SQL 1,901