Using positive tainting and syntax-aware evaluation to counter SQL injection attacks
Finding application errors and security flaws using PQL: a program query language