41/41
Automated assertions passed
Detection, safe fixes, backup and restore, output formats, false-positive fixtures, and runtime boundaries.
Test suite resultFixed price · Safe patches only · Remote
Expose Legacy
PHP Risks & Fix
What Can Be Proven.
GXT scans the code, names the exact file and line, patches only behavior-preserving fixes, syntax-checks every changed file, and keeps the original bytes ready to restore.
STATUS: REVIEW REQUIRED12 findings · 6 provable fixesREPORT
HIGH checkout.php:84 · request input reaches query
HIGH upload.php:31 · dynamic include path
MED helpers.php:13 · removed PHP 8 syntax
SAFE dirname(__FILE__) → __DIR__
PASS php -l · no syntax errors detected
HIGH upload.php:31 · dynamic include path
MED helpers.php:13 · removed PHP 8 syntax
SAFE dirname(__FILE__) → __DIR__
PASS php -l · no syntax errors detected
Original filesBACKED UP
Runtime buildCHECKED
The difference
A scan that tells you what happens next.
No mystery score. No quiet rewrite of business logic. Every result lands in one of two lanes.
Reported for human review
SQL and input pathsFile + line + severity
Authentication logicNever changed silently
Includes and executionExact risk described
Runtime exposureFixed build identified
→
Patched when equivalent
Removed PHP syntaxProvable replacement
Deprecated formsBehavior preserved
Every changed file
php -l verifiedOriginal bytesRestore-ready backup
Proof from the tool
Built, tested, and deliberately limited.
These are measured results from the bundled demo and automated test suite—not client claims.
12
Provable demo edits
Six legacy demo files patched, then syntax-checked. High-risk findings remain visible for review.
Bundled demo run0
Business-logic guesses
Queries, authentication, pricing, redirects, and code paths are reported—not quietly rewritten.
Safety ruleTransparent fixed blocks
Know the price before access.
Start read-only. Approve the patch scope separately. Extra time is quoted before it is spent. Payments are processed securely by Square.
Scope, stated plainly
Safe automation stops where judgment begins.
Fixed automatically
- Curly string offsets converted to square brackets
dirname(__FILE__)replaced with__DIR__- Deprecated interpolation syntax corrected
- Removed raw POST global replaced with its input stream
- Optional short-tag and trailing close-tag cleanup
Reported, not rewritten
- SQL injection and request-data paths
- Shell execution, dynamic includes, and eval
- Password hashing and authentication behavior
- Business logic, checkout, forms, and emails
- Framework, database, hosting, and runtime upgrades
Find out what is actually in the code.
Send the site URL, current PHP version if known, and your preferred access method. GXT confirms fit and scope before any patch work begins.
Frequently asked
Before we touch the site.
Does the $89 check change my website?＋
No. It is read-only. GXT scans PHP files and checks the declared or detected runtime build, then delivers written findings.
What fits inside the $149 patch block?＋
Up to two hours for backups, behavior-preserving fixes, syntax verification, and a written summary. Anything beyond the block is quoted first.
Is this a penetration test or security guarantee?＋
No. It is a pattern-level PHP scan and compatibility check. A clean result does not prove the entire application is secure.
Will GXT upgrade PHP, Drupal, WordPress, or hosting?＋
Not under these fixed blocks. Framework upgrades, migrations, hosting changes, malware response, and runtime patching are separate scopes.