问题:

Is there a static analysis tool for identifying sql injection for php/mysql.

A tool which run on a php script would analyze the sql statements and find if there are any possible sql injection possibilities for the sql statements.

回答1:

Not sure if a tool like that exists for PHP Script, but the security compass tools are great for a first analysis :

http://labs.securitycompass.com/index.php/exploit-me/

回答2:

What I found is rather disappointing.

RATS (branded as Fortify) has some PHP suport, but it doesn't detect SQL injections. Apparently HP guys are focused on .NET and Java apps.

OWASP SWAAT Project seems to be dead to me.

RIPS Scanner is a tool you can install on your web server and navigate in the source of your application on the web interface. Unfortunately it just hangs for me when I open it.

There is an online tool called DevBug. It is not very useful to scan your entire codebase, but it's good for beginners to practice security.