Template injection (ARCH7130)

Key php.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template string itself from user input lets the engine evaluate attacker-controlled expressions, leading to remote code execution (SSTI). User data must be passed only as template variables.

Incorrect

<?php
$loader = new \Twig\Loader\ArrayLoader([
    'page' => 'Hello ' . $_GET['name'],
]);
$twig = new \Twig\Environment($loader);
echo $twig->render('page');

Correct

<?php
$loader = new \Twig\Loader\ArrayLoader([
    'page' => 'Hello {{ name }}',
]);
$twig = new \Twig\Environment($loader);
echo $twig->render('page', ['name' => $_GET['name']]);

Fix

Keep the template text static and pass user data as a render variable, never as an expression.