Automated Security Review of PHP Web Applications with Static Code Analysis

Static code analysis is a class of techniques for inspecting the source code of a computer program without executing it. One specific use of static analysis is to automatically scan source code for potential security problems, reducing the need for manual code reviews. Many web applications written in PHP suffer from injection vulnerabilities, and static analysis makes it possible to track down these vulnerabilities before they are exposed on the web. In this thesis, we evaluate the current state of static analysis tools targeted at the security of PHP web applications. We define an objective benchmark consisting of both synthetic and real-world tests, that we use to examine the capabilities and performance of these tools. With this information, we determine if any of these tools are suited for use in a system that automatically checks the security of web applications, and rejects unsecure applications before they are deployed onto a web server.