WeVerca: Web Applications Veri cation for PHP (Tool Paper)?

Static analysis of web applications developed in dynamic languages is a challenging yet very important task. In this paper, we present WeVerca, a framework that allows one to de ne static analyses of PHP applications. It supports dynamic type system, dynamic method calls, dynamic data structures, etc. These common features of dynamic languages cause implementation of static analyses to be either imprecise or overly complex. Our framework addresses this problem by de ning enduser static analyses independently of value and heap analyses necessary just to resolve these features. As our results show, taint analysis de ned using the framework found more real problems and reduced the number of false positives comparing to existing state-of-the-art analysis tools for PHP.