SQL injection finders [closed]

Question

We have a Java based client/server project. Recently one of the testers has found a SQL injection vulnerability while testing the application.

We do not have enough resources to manually check the application for SQL injections.

Are there any SQL injection finders / static code analyzers that find SQL vulnerabilities in Java code?

Answer 1

Yes!

Here are some:

• Armorize CodeSecure
• FindBugs
• YASCA
• HP Fortify Static Code Analyzer
• Parasoft
• klockwork INSIGHT
• coverity Static Analysis
• VeraCode
• Checkmarx
• IBM Appscan

Read: OWASP's List of Source Analysis Tools