Is there a static analysis tool for identifying sq

2019-05-26 06:54发布

Is there a static analysis tool for identifying sql injection for php/mysql.

A tool which run on a php script would analyze the sql statements and find if there are any possible sql injection possibilities for the sql statements.

2条回答
做个烂人
2楼-- · 2019-05-26 07:18

Not sure if a tool like that exists for PHP Script, but the security compass tools are great for a first analysis :

http://labs.securitycompass.com/index.php/exploit-me/

查看更多
We Are One
3楼-- · 2019-05-26 07:43

What I found is rather disappointing.

RATS (branded as Fortify) has some PHP suport, but it doesn't detect SQL injections. Apparently HP guys are focused on .NET and Java apps.

OWASP SWAAT Project seems to be dead to me.

RIPS Scanner is a tool you can install on your web server and navigate in the source of your application on the web interface. Unfortunately it just hangs for me when I open it.

There is an online tool called DevBug. It is not very useful to scan your entire codebase, but it's good for beginners to practice security.

查看更多
登录 后发表回答