A survey on server-side approaches to securing web applications
Static detection of security vulnerabilities in scripting languages