A specialized security tool for auditing PHP/Yaf projects to identify SQL injection vulnerabilities and generate safe, parameterized query patches.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install php-sql-fixer
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install php-sql-fixer using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is php-sql-fixer?
The php-sql-fixer is a robust security utility designed specifically for PHP 7.3+ and Yaf framework environments. It streamlines the lifecycle of database security by scanning source code for risky patterns like string concatenation in SQL, unsafe superglobal interpolation, and dangerous sprintf usage. By integrating this into Openclaw Skills, developers can automate the discovery of vulnerabilities and receive immediate, context-aware fix suggestions.
Beyond simple detection, the tool focuses on maintainability. It generates patches that adhere to existing project database abstraction patterns (like PDO or custom models) without unnecessary refactoring. This ensures that security fixes are surgical, targeted, and compliant with the original project architecture, making it an essential asset for legacy code modernization and proactive security auditing.
php-sql-fixer Use Cases
- Auditing legacy PHP and Yaf framework applications for SQL injection vulnerabilities.
- Automating the generation of parameterized query patches for string-concatenated SQL statements.
- Validating user-controlled input paths from $_GET, $_POST, and $_REQUEST to database queries.
- Implementing bulk security fixes across large codebases during migration or security sprints.
- Verifying code integrity and syntax post-fix using integrated PHP linting workflows.
How php-sql-fixer Works
- The scanner script analyzes the project root to flag candidates involving string concatenation or unsafe variable interpolation in SQL strings.
- Developers triage findings by examining the surrounding code context to confirm if user-controlled input reaches the flagged SQL.
- The suggestion engine generates annotated before/after fix snippets tailored to the specific code pattern detected.
- Fixes are applied using parameterized queries while maintaining the existing database abstraction layer (e.g., PDO or custom Yaf models).
- A final verification step involves syntax checking via PHP-L and a re-scan to ensure all identified risks have been mitigated.
php-sql-fixer Setup
To start using this tool within your Openclaw Skills environment, ensure you have bash, grep, and PHP installed. Use the following commands to initiate a scan:
# Navigate to your skill directory and run the scanner
bash "$SKILL_DIR/scripts/scan_sql.sh" <project-root> [output-file]
# Generate fix suggestions for a specific file
php "$SKILL_DIR/scripts/suggest_fix.php" <file-path>
php-sql-fixer Data Schema & Taxonomy
The skill organizes findings and remediation data through a structured workflow. It relies on the following taxonomy for findings:
| Classification | Description |
|---|---|
| Confirmed | User-controlled input directly reaches the SQL string without sanitization. |
| Suspected | Likely risky, but input source is ambiguous or partially sanitized. |
| False Positive | SQL built from constants, whitelisted values, or pre-cast integers. |
All fixes are annotated with a // FIXED: sql injection comment to track modifications within the version control system.
php-sql-fixer Advanced Features
- Support for complex SQL patterns including IN clauses with dynamic arrays in PHP 7.3.
- Custom Yaf Model integration allowing for array-based condition building instead of raw strings.
- Context-aware fix generation that respects existing project DB patterns (PDO vs Custom Wrappers).
- Bulk fix prioritization guidance focusing on high-risk paths like payments and authentication.
- Integration with Docker-based environments for seamless syntax validation.
SKILL.md
Loading
Related Openclaw Skills
Horizontal-Vertical Analysis Framework
A sophisticated dual-axis research methodology that synthesizes historical evolution with contemporary competitive landscapes to uncover hidden strategic insights.
Video Generator Free No Limit
A professional AI video creation tool that transforms text and images into 1080p MP4 videos through a cloud rendering pipeline without usage caps.
AI Subtitle Translator Free
An AI-powered cloud video processing skill that translates subtitles into multiple languages and renders 1080p localized videos in under a minute.
Video Editing AI Application
An AI-driven video editing skill that automates the transformation of raw footage into professional 1080p MP4 clips via cloud GPU rendering.
Text to Video Deevid
Generate professional 1080p AI videos from 150-word scripts or simple text prompts in minutes using Openclaw Skills.
Rasptorch
A high-performance CLI toolset for managing tensors and building neural networks with native Vulkan GPU support.
Featured*
