This rule is deprecated, and will eventually be removed.

Reading Standard Input is security-sensitive. It has led in the past to the following vulnerabilities:

- CVE-2005-2337
- CVE-2017-11449

It is common for attackers to craft inputs enabling them to exploit software vulnerabilities. Thus any data read from the standard input (stdin) can be dangerous and should be validated.

This rule flags code that reads from the standard input.

## Ask Yourself Whether

- data read from the standard input is not sanitized before being used.

You are at risk if you answered yes to this question.

## Recommended Secure Coding Practices

Sanitize all data read from the standard input before using it.

## Sensitive Code Example

    // Any reference to STDIN is Sensitive
    $varstdin = STDIN; // Sensitive
    stream_get_line(STDIN, 40); // Sensitive
    stream_copy_to_stream(STDIN, STDOUT); // Sensitive
    // ...

    // Except those references as they can't create an injection vulnerability.
    ftruncate(STDIN, 5); // OK
    ftell(STDIN); // OK
    feof(STDIN); // OK
    fseek(STDIN, 5); // OK
    fclose(STDIN); // OK

    // STDIN can also be referenced like this
    $mystdin = 'php://stdin'; // Sensitive

    file_get_contents('php://stdin'); // Sensitive
    readfile('php://stdin'); // Sensitive

    $input = fopen('php://stdin', 'r'); // Sensitive
    fclose($input); // OK

## See

- CWE - CWE-20 - Improper Input Validation