Taint 是一個擴充套件，用於偵測 XSS 程式碼（受污染的字串）。它也可以用來發現 SQL 注入漏洞、Shell 注入等。
當 Taint 啟用時，如果您將受污染的字串（來自 $_GET、$_POST 或 $_COOKIE）傳遞給某些函式，Taint 會發出警告。
範例 #1 Taint() 範例
<?php
$a = trim($_GET['a']);
$file_name = '/tmp' . $a;
$output = "Welcome, {$a} !!!";
$var = "output";
$sql = "Select * from " . $a;
$sql .= "ooxx";
echo $output;
print $$var;
include $file_name;
mysql_query($sql);
?>以上範例會輸出類似以下的內容
Warning: main() [function.echo]: Attempt to echo a string that might be tainted Warning: main() [function.echo]: Attempt to print a string that might be tainted Warning: include() [function.include]: File path contains data that might be tainted Warning: mysql_query() [function.mysql-query]: SQL statement contains data that might be tainted