I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, XSS, etc. I've gone through most of my code manually, but with a few hundred thousand lines of code, I'm sure I missed things. If possible, are there any tools that can be downloaded and analyze code on my local machine rather than installing to the live server (this isn't a requirement if not)?
There's a static code analysis tool for PHP called RIPS. I've not had the chance to use it as yet, but it sounds like it's in the right kind of area for what you're looking to do.
On the commercial tool side of things, Fortify SCA has support for PHP, as far as I know.
Check out YASCA. From their own site: it's a "glorified grep script" plus an aggregator of other open-source tools". I've had some success with this discovering security issues is the past, although I'd have to agree with the previous post that the commerical alternatives I've tried really are a couple of moves ahead.
AppScan Source, a commercial tool from IBM, also has support for PHP.
Unfortunately, the free tools aren't that great; they're pretty limited, not so easy to use for a security novice, and/or have only limited coverage of potential security issues.
You could look at free web pentesting tools, e.g., Burp Suite. For more recommendations, see, e.g., the following questions on this site: security assessment, pen testing tools. However realize that they have limited coverage and will miss many vulnerabilities.
The Spike PHP Security Audit Tool is another static analysis tool to scan for security problems in PHP code.
- QualysGuard WAS
These will scan and audit your server/website and return insecurities. They are very useful.