PHP code example of enshrined / wp-taint

1. Go to this page and download the library: Download enshrined/wp-taint library. Choose the download type require.

2. Extract the ZIP file and open the index.php.

3. Add this code to the index.php.

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

enshrined / wp-taint example snippets


$slug = esc_html( $_GET['slug'] );
$wpdb->query( "SELECT * FROM wp_items WHERE slug = '{$slug}'" );


$wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}items WHERE slug = %s", $_GET['slug'] ) );


// wp-taint-ignore-next-line wp.xss.unescaped-output -- output is admin-only, reviewed 2026-08
echo $markup;


HIGH      wp.xss.unescaped-output
  _unslash( $_GET['report_filter'] );
    sink      :47:10  echo $this->build_header( $filter );

  Untrusted input reaches output without HTML escaping.
  Run with --verbose for the full path.
─────────────────────────────────────────────────────────────
  0 critical   1 high   0 medium   0 low
  1 finding in 1 file · 18 files scanned · 0.2s
─────────────────────────────────────────────────────────────

  Why is a value tainted? Ask about the line:
  wp-taint explain ./src/

bash
wp-taint explain




  return '<h2>' . $label . '</h2>';

  Taint at this point: (none)

  Why:
    - sanitize: esc_html() clears html. (none) survives.