// CTF CHALLENGE 09

Code Audit (SAST)

PR #404: Security Review

The dev team pushed legacy code to main. As a DevSecOps analyst, your pipeline blocked the commit due to insecure functions. Enter the exact name of the secure PHP function that should be used to fix each vulnerability.

[ ! ] Vulnerability: Cross-Site Scripting (XSS)

<div class="comment">
    <?php echo $_POST['user_comment']; ?>
</div>

[ ! ] Vulnerability: SQL Injection (SQLi)

$email = $_GET['email'];
$db->query("SELECT * FROM users WHERE email = '$email'");

[ ! ] Vulnerability: Insecure Cryptography

$pass = $_POST['password'];
$secure_pass = md5($pass);
saveToDatabase($secure_pass);