psalm/docs/running_psalm/issues/TaintedText.md

TaintedText

Emitted when tainted text is detected somewhere unexpected.

This can lead to dangerous situations, like running arbitrary functions.

<?php

$name = $_GET["name"];

evalCode($name);

function evalCode(string $name) {
    if (is_callable($name)) {
        $name();
    }
}