CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks
Static detection of security vulnerabilities in scripting languages