For those who haven't yet seen this, .mario and christ1an over at sla.ckers has been working on a PHP Intrusion Detection System and the results are fairly promising! The system is based on regular expressions and seems to catch everything I've jammed into it so far. Here's an example of catching a JavaScript event handler:

rule: (on\w+\s*=.*\\?([("|'|`)]|\>)?)

rule-description: detects possible event handlers

impact: 4

Check out the Google Group and the live sandbox for more.

References

This reference list has been generated, in many cases, through an automated process and may therefore contain errors or incomplete metadata. It is provided purely as assistance for finding the items mentioned within this post.

  1. .mario's security blog <http://mario.heideri.ch/>
  2. christ1an's security blog <http://christ1an.blogspot.com/>
  3. PHP IDS live sandbox demo <http://phpids.heideri.ch/>