title: Writing static code analysis tools
body: <p>I'd like to write a static code analysis tool for finding SQLi vulnerabilities in PHP code. Usually, I just use a script to separate functions, and grep them for inadequate sanitisation. Obviously this approach is limited.</p>
  
  <p>The outline of the program I want to write is:</p>
  
  <ol>
  <li>Find all calls to mysql_query</li>
  <li>Find all references to the functions that call mysql_query</li>
  <li>Track all variables that go into each query call, and find out if mysql_real_escape_string is run on them.</li>
  </ol>
  
  <p>I'm caught between two approaches to writing this. Either I go for a PHP extension, or write it as a standalone from scratch.</p>
  
  <p>The advantages of using a PHP extension is that I wouldn't have to make my own tokenizer, parser etc (I presume, basing this on the capabilities of the XDebug extension).</p>
  
  <p>Does anyone with experience in writing PHP extensions have any advice on how to approach the problem?</p>