Using positive tainting and syntax-aware evaluation to counter SQL injection attacks
Static detection of security vulnerabilities in scripting languages