Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.

$entityId = $_GET["name"];

public function getMetaData($entityId) {

Note that using string as the assertion is deprecated since PHP 7.2.

PHP assert

1 Answer 1


The assert function will be called with one static parameter, the string is_string($entityId).

Thanks to the usage of single quotes, $entityId won't be interpolated, so an attacker won't be able to execute any PHP code.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .