I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer.
These files are not obfuscated or encrypted and they will not have any obvious oddities such as a header that starts with "GIF89a". What I wanted to check for are any somewhat less obvious oddities such as code that could be used to implement a backdoor.
[Update - highlighted this previously included sentence:] So what I would like to do is an eyeball scan for keywords or simple constructs in the source code that can be used for this purpose. My thought is that I would request a clarification from the developer for any thing I may find (if I am not able to determine what it does) rather than ask him to explain every line in every file.
The web application only uses server side PHP 5.6 and client side JS (besides CSS and HTML). So any backdoor functionality would be limited to what these technologies can provide.
One of the constructs that I will be looking for in the PHP and JS files are any expressions containing an eval() statement.
Are there any other keywords besides eval that I could check for?
[Additional update:] At this stage I was just looking for an eyeball scan of items that may require a further discussion with the developer. Because of time and other constraints I was not looking to avoid all possible exploits, nor am I looking to understand every the thousands of lines of code that will be on these files.