I’ve always thought that secure web applications must be built secure and no matter how many patches are released during an application’s life cycle, secure coding and secure code are the fundamental pillars of secure web. 

Defending a vulnerable web application with one Web Application Firewall should only buy you some time toactually fix the vulnerabilities. I strongly believe that virtual patching is just a buzz marketing crap word.  Always fix the code !

Just a few days after I found a static .Net  XSS code analyzer , today I’ve found a PHP XSS and SQL injection source code analyzer called Pixy.

Download and install Pixy today and please share the experience !