I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, XSS, etc. I've gone through most of my code manually, but with a few hundred thousand lines of code, I'm sure I missed things. If possible, are there any tools that can be downloaded and analyze code on my local machine rather than installing to the live server (this isn't a requirement if not)?
locked by AviD♦ Oct 18 '12 at 16:50
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
migrated from serverfault.com Mar 13 '11 at 2:34
This question came from our site for system and network administrators.
There's a static code analysis tool for PHP called RIPS. I've not had the chance to use it as yet, but it sounds like it's in the right kind of area for what you're looking to do.
On the commercial tool side of things, Fortify SCA has support for PHP, as far as I know.
Check out YASCA. From their own site: it's a "glorified grep script" plus an aggregator of other open-source tools". I've had some success with this discovering security issues is the past, although I'd have to agree with the previous post that the commerical alternatives I've tried really are a couple of moves ahead.
AppScan Source, a commercial tool from IBM, also has support for PHP.
Unfortunately, the free tools aren't that great; they're pretty limited, not so easy to use for a security novice, and/or have only limited coverage of potential security issues.
You could look at free web pentesting tools, e.g., Burp Suite. For more recommendations, see, e.g., the following questions on this site: security assessment, pen testing tools. However realize that they have limited coverage and will miss many vulnerabilities.
The Spike PHP Security Audit Tool is another static analysis tool to scan for security problems in PHP code.
- QualysGuard WAS
These will scan and audit your server/website and return insecurities. They are very useful.