mlsanityData to 14 Oct 2026

LLMs in Web Development: Evaluating LLM-Generated PHP Code Unveiling Vulnerabilities and Limitations

arXiv 2404.14459 ↗First posted 21 Apr 2024cs.SE cs.AIcited by 22

Not on the map. Why?

Abstract (arXiv)

This study evaluates the security of web application code generated by Large Language Models, analyzing 2,500 GPT-4 generated PHP websites. These were deployed in Docker containers and tested for vulnerabilities using a hybrid approach of Burp Suite active scanning, static analysis, and manual review. Our investigation focuses on identifying Insecure File Upload, SQL Injection, Stored XSS, and Reflected XSS in GPT-4 generated PHP code. This analysis highlights potential security risks and the implications of deploying such code in real-world scenarios. Overall, our analysis found 2,440 vulnerable parameters. According to Burp's Scan, 11.56% of the sites can be straight out compromised. Adding static scan results, 26% had at least one vulnerability that can be exploited through web interaction. Certain coding scenarios, like file upload functionality, are insecure 78% of the time, underscoring significant risks to software safety and security. To support further research, we have made the source codes and a detailed vulnerability record for each sample publicly available. This study emphasizes the crucial need for thorough testing and evaluation if generative AI technologies are used in software development.

Key facts. Cited by 22 papers in the map (data through 14 Oct 2026). Builds on 16 of its 32 references that are in the map. First posted on arXiv 21 Apr 2024.

Builds on

16 of 32 references.

References · 16

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2023GPT-4 Technical Reportcited by 18,396
  3. 2022Beyond the Imitation Game: Quantifying and extrapolating the capabilities of language modelscited by 1,998
  4. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  5. 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 654
  6. 2023Self-collaboration Code Generation via ChatGPTcited by 258
  7. 2022Do Users Write More Insecure Code with AI Assistants?cited by 192
  8. 2023DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detectioncited by 102
  9. 2023The Programmer's Assistant: Conversational Interaction with a Large Language Model for Software Developmentcited by 96
  10. 2023A New Era in Software Security: Towards Self-Healing Software via Large Language Models and Formal Verificationcited by 42
  11. 2023The FormAI Dataset: Generative AI in Software Security Through the Lens of Formal Verificationcited by 34
  12. 2023CodeTF: One-stop Transformer Library for State-of-the-art Code LLMscited by 21
4 more
  1. 2023A/B Testing: A Systematic Literature Reviewcited by 16
  2. 2024All Artificial, Less Intelligence: GenAI through the Lens of Formal Verificationcited by 11
  3. 2023Learning Defect Prediction from Unrealistic Datacited by 5
  4. 2023NoCodeGPT: A No-Code Interface for Building Web Apps with Language Modelscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 6; 2025: 13; 2026: 3.

22 papers.

Sort:

By area:

  1. 2024From LLMs to LLM-based Agents for Software Engineering: A Survey of Current, Challenges and Futurecited by 86
  2. 2025Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AIcited by 42
  3. 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
  4. 2024The Impact of Prompt Programming on Function-Level Code Generationcited by 13
  5. 2024A Deep Dive Into Large Language Model Code Generation Mistakes: What and Why?cited by 10
  6. 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Securitycited by 10
  7. 2025CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detectioncited by 10
  8. 2025Vulnerability Detection: From Formal Verification to Large Language Models and Hybrid Approaches: A Comprehensive Overviewcited by 7
  9. 2025The Hidden Risks of LLM-Generated Web Application Code: A Security-Centric Evaluation of Code Generation Capabilities in Large Language Modelscited by 7
  10. 2025CodeMirage: A Multi-Lingual Benchmark for Detecting AI-Generated and Paraphrased Source Code from Production-Level LLMscited by 6
  11. 2025How Safe Are AI-Generated Patches? A Large-scale Study on Security Risks in LLM and Agentic Automated Program Repair on SWE-benchcited by 5
  12. 2025Automated Consistency Analysis of LLMscited by 4
10 more
  1. 2025Curiosity by Design: An LLM-based Coding Assistant Asking Clarification Questionscited by 4
  2. 2024TaskEval: Assessing Difficulty of Code Generation Tasks for Large Language Modelscited by 3
  3. 2025Evaluating LLaMA 3.2 for Software Vulnerability Detectioncited by 3
  4. 2024Automatic Detection of LLM-Generated Code: A Comparative Case Study of Contemporary Models Across Function and Class Granularitiescited by 1
  5. 2025Generative AI for Internet of Things Security: Challenges and Opportunitiescited by 1
  6. 2025How Good LLM-Generated Password Policies Are?cited by 0
  7. 2025CrossPL: Evaluating Large Language Models on Cross Programming Language Code Generationcited by 0
  8. 2026Evaluating the Use of LLMs for Automated DOM-Level Resolution of Web Performance Issuescited by 0
  9. 2026Assessing Spear-Phishing Website Generation in Large Language Model Coding Agentscited by 0
  10. 2026Security in LLM-Assisted Coding: A Systematic Literature Reviewcited by 0