Audit required: Insecure use of logger PHP-A1011
Security
Major
cwe-117
a10 2017
cwe-532
a09
sans top 25
owasp top 10
Logging user-provided values directly can put application vulnerable to multiple attack vectors. Superglobal variables contains values specified by the user, which are considered as tainted and untrusted. Therefore, it is discouraged to pass these variables directly to the logger.
Bad practice
error_log($_POST);
Recommended
error_log('Message: ' . $_POST['message']);