\begin{enumerate}[label={5.\arabic*}]
	\item\pass{} Verify that the runtime environment is not susceptible to buffer
		overflows, or that security controls prevent buffer overflows.

		As of \emph{OWASP}'s statement\footnote{\url{%
			https://www.owasp.org/index.php/Buffer_Overflows\#Platforms_Affected}}
		\PHP{} is not surceptible to buffer overflows as long no external
		programs or extensions are used which is not the case.
	% They skip 5.2
	\addtocounter{enumi}{1}
	\item\fail{} Verify that server side input validation failures result in 
		request rejection and are logged.

		\texttt{filter\_var} is used for input validation and while errors are
		returned to the user, no logging taking place.
	% They skip 5.4
	\addtocounter{enumi}{1}
	\item\pass{} Verify that input validation routines are enforced on the server
		side.

		Errors are accumulated in an array which, when non-empty, will fail the
		function and report the error.
	\notapplicable{\item Verify that a single input validation control is used
		by the application for each type of data that is accepted.}

	% They skip 5.7-5.9
	\addtocounter{enumi}{3}
	\item\fail{} Verify that all SQL queries, HQL, OSQL, NOSQL and stored 
		procedures, calling of stored procedures are protected by the 
		use of prepared statements or query parameterization, and 
		thus not susceptible to SQL injection.

		This is not the case. For example in \srcref{users.php}{45}. However,
		in some cases prepared statements are used, such as is
		\srcref{users.php}{145}.
	\item\pass{} Verify that the application is not susceptible to LDAP
		Injection, or that security controls prevent LDAP Injection.

		\LDAP{} is not used, thus the application is not susceptible.
	\item\pass{} Verify that the application is not susceptible to OS Command
		Injection, or that security controls prevent OS Command Injection.

		This requirement heavily depends on the configuration of the \PHP{}
		interpreter and database. There are no system commands used but since
		it is trivial to do an \SQL{} injection it might be possible to run
		commands via the database. However, which a sufficiently secure \SQL{}
		config this can not take place.
\end{enumerate}
