DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
PHP

PHP

Made by DeepSource
Use Analyzer

Audit required: Presence of debug function found PHP-A1012

Security
Critical
 cwe-117 cwe-223 a10 2017 a09 sans top 25 owasp top 10

Debugging functions such as var_dump, print_r or var_export should not be kept in production code. These functions display information about the variable, which can be helpful during development. However, if they contain any sensitive information, the presence of these functions in production code can expose that. Therefore, it is advised to avoid using it in production.

Bad practice

function getUser() {
    $query = buildQuery('users', ['*']);

    var_dump($query);
}

Recommended

function getUser() {
    $query = buildQuery('users', ['*']);

    Log::info(print_r($query, true));
}

References