Add PHP language support for web application validation

[rudra496]

Summary

Add PHP language support. PHP powers 77% of websites and AI tools frequently generate vulnerable PHP code.

Patterns to Detect

Security

• eval(), assert() — code injection
• mysqli_query() with string interpolation — SQL injection
• $_GET, $_POST used directly in queries
• exec(), shell_exec(), system(), passthru() — command injection
• include() / require() with user input — LFI/RFI
• echo $_SERVER['PHP_SELF'] — XSS
• preg_replace() with /e modifier
• unserialize() on user input — PHP object injection
• header() redirect without exit
• extract() — variable injection

Hallucinations

• Non-existent PHP functions
• Invented WordPress/WooCommerce hooks
• Fake Laravel facades
• Non-existent PECL extensions

Logic

• Empty catch blocks
• == instead of === (type coercion bugs)
• Missing isset() checks
• Resource leaks (unclosed DB connections, file handles)

Acceptance Criteria

• .php files auto-detected
• At least 10 PHP-specific security patterns
• Framework-specific checks (Laravel, WordPress)
• Tests with OWASP PHP vulnerable examples
• Documentation updated

Difficulty

Intermediate — PHP has consistent syntax patterns well-suited for regex analysis.