Hey everyone! I've been deep in the weeds of a legacy project that's been... interesting, to say the least. We have a monolithic PHP 5.6 (yes, I know 😅) application that's been patched and extended over a decade. It's a classic case of mixed PHP paradigms—procedural scripts, some early OOP attempts, and a whole lot of direct `mysql_*` calls and `echo $_POST['field']` patterns. Our team is finally getting budget to seriously tackle security tech debt, with a focus on finding and fixing the rampant Cross-Site Scripting (XSS) and SQL Injection (SQLi) vulnerabilities we *know* are in there.
We're evaluating SAST tools, and Checkmarx is obviously a major player on the list. I'm curious about real-world experiences from this community, specifically for a use case like ours.
* **Language/Framework Focus:** It's mostly "vanilla" legacy PHP, not a modern framework like Laravel or Symfony. How well does Checkmarx handle the old `mysql_query()` and `echo`-based templating?
* **Pattern Detection:** We need something that can effectively trace tainted data from `$_GET`, `$_POST`, and `$_COOKIE` all the way through to `echo` or `mysql_query` calls, even when it's passed through a few global functions or included files. Does its engine handle this convoluted flow well?
* **Noise vs. Signal:** With messy legacy code, every tool throws up a mountain of issues. How is Checkmarx's triage experience for cutting down false positives on older code patterns? Can you easily mark legacy, risk-accepted sinks or sanitizers?
* **Integration & Speed:** The codebase is large. How's the scan performance for a monolithic app, and what's the learning curve like for integrating it into a slow-moving CI/CD pipeline (think Jenkins)?
I'm also weighing it against other SAST options like Fortify and SonarQube for this specific tech stack. If you've used Checkmarx in a similar "rescue mission" for a legacy PHP app, I'd love to hear:
* What your setup process was like.
* How many of the critical XSS/SQLi findings were truly novel vs. things you already knew about.
* Any pitfalls you hit with configuration or custom query tuning to get good results.
The goal is to build a clean, prioritized backlog of fixes for the dev team, not to drown in thousands of generic warnings. Practical, actionable insights would be incredibly valuable!
TIL
Pipeline is king.