Testing Tools for Static Code Analysis of Applications Written in PHP Programming Language

U ovom radu proučene su tehnike te načini na koji općenito rade alati za statičku analizu koda koji pronalaze sigurnosne propuste. Pri tome je bio naglasak na programskom jeziku PHP i načinu na koji dolazi do sigurnosnih propusta unutar PHP-a. Pronađeni su alati za statičku analizu koda pisanog u programskom jeziku PHP te su izdvojeni i objašnjeni najkorisniji od njih. Nakon toga je pronađena baza s izvornim kodovima ispitnih slučajeva uz pomoću koje se napravila struktura repozitorija na kojoj se mogu vršiti testiranja alata za statičku analizu koda. Na kraju je napravljena skripta pomoću koje se mogu pokrenuti svi statički analizatori koda odjednom nad ispitnim slučajevima unutar repozitorija.This paper describes techniques and ways that have been studied in which generic static code analysis tools are used to find security vulnerabilities. There was an emphasis on PHP programming language and the way PHP vulnerabilities occur. Then, static code analysis tools for the code that was written in the PHP programming language were found and explained the most useful of them. Afterwards, a base with the source code of the test cases was found, which was used to create a repository that could be used to test the static code analysis tools. At the end, a script was created by which all static analyzers could be run at once on test cases within the repository