Static Analysis

Third generation algorithms.

Sophisticated RIPS Engine

The RIPS PHP code analysis engine is armed with innovative static code analysis algorithms that are specifically dedicated to the intricate features of the PHP language.

  • Capable of analyzing modern PHP applications for complex security vulnerabilities in minutes.
  • Supports the full feature stack of the PHP language, including object-oriented code, pitfall-prone security mechanisms, and PHP built-in functions.
  • Detects security vulnerabilities accurately by analyzing the data flow from user-controlled input parameters to sensitive operations in your application with 100% code coverage.
  • Prevents false positives by evaluating the interaction of applied security mechanisms with the different input types, markup contexts and sensitive operations.
  • Detects second-order vulnerabilities and vulnerabilities that stem from a vulnerable PHP core.

Supported PHP Versionsall (3-7)
Maximum Code Sizeunlimited
Vulnerability Categories40+
Vulnerability ReportsDashboard, PDF, CSV
Hosted Solution
Local Installation
Scripting API
Continuous Integration
Supported StandardsOWASP, CWE, SANS, PCI-DSS

We evaluated a few products and chose RIPS because it performs really well, and has a strong ability to follow tainted data across the scanned application - which is very important for any SAST solution. Further, our security champions learn more from RIPS findings, as they gain a much better understanding of the vulnerabilities discovered during scans.

Dinis Cruz, Application Security Specialist


Analysis Example

$id = $_POST['id']; // user input
if(...) {
   $id = (int)$id; // safe
else {
   $id = htmlentities($id); // !
echo "<div id='$id'>"; // XSS

Cross-Site Scripting
(single-quoted attribute)

$id = $_POST['id'];
$id = htmlentities($id);
echo "<div id='$id'>";

Supported Vulnerability Types

OWASP Top 10

The OWASP Top 10 lists the 10 most critical security risks that occur frequently in web applications. It is referenced by many standards, books, tools, and organizations, including MITRE, PCI DSS, DISA, and FTC.

RIPS is able to identify 9 out of the 10 risks that can be detected by static analysis software, helps you quickly locate them in your application, and provides detailed information on how to fix the risks.

A2Broken Authentication and Session Management
A3Cross-Site Scripting (XSS)
A4Insecure Direct Object References
A5Security Misconfiguration
A6Sensitive Data Exposure
A7Missing Function Level Access Control
A8Cross-Site Request Forgery
A9Using Components with Known Vulnerabilities
A10Unvalidated Redirects and Forwards


The Data Security Standard from the Payment Card Industry, short PCI DSS, specifies 12 compliance requirements when processing credit card information in your software. Specifically, RIPS helps to audit the following requirements:

3.Protect stored cardholder data
4.Encrypt transmission of cardholder data across networks
6.Develop and maintain secure systems and applications
6.1Establish a process to identify security vulnerabilities and assign a risk ranking
6.2Protect all system components and software from known vulnerabilities
6.3Incorporate information security throughout the software development life cycle.
6.4Ensure all relevant PCI DSS requirements are implemented on new or changed systems after significant changes.
6.5Prevent common coding vulnerabilities in software development processes by developing applications based on secure coding guidelines
6.6Ensure all public-facing web applications are protected against known attacks
11.Regularly test security systems and processes


The CWE/SANS Top 25 Most Dangerous Software Errors is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software (please note: not all vulnerability types apply to PHP code).

RIPS is able to detect 22 out of the SANS Top 25 Most Dangerous Software Errors that can be detected by static analysis software, helps you quickly locate them in your application, and provides detailed information on how to fix the risks.

189Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
278Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
3120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
479Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
5306Missing Authentication for Critical Function
6862Missing Authorization
7798Use of Hard-coded Credentials
8311Missing Encryption of Sensitive Data
9434Unrestricted Upload of File with Dangerous Type
10807Reliance on Untrusted Inputs in a Security Decision
11250Execution with Unnecessary Privileges
12352Cross-Site Request Forgery (CSRF)
1322Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
14494Download of Code Without Integrity Check
15863Incorrect Authorization
16829Inclusion of Functionality from Untrusted Control Sphere
17732Incorrect Permission Assignment for Critical Resource
18676Use of Potentially Dangerous Function
19327Use of a Broken or Risky Cryptographic Algorithm
20131Incorrect Calculation of Buffer Size
21307Improper Restriction of Excessive Authentication Attempts
22601URL Redirection to Untrusted Site ('Open Redirect')
23134Uncontrolled Format String
24190Integer Overflow or Wraparound
25759Use of a One-Way Hash without a Salt

Many More

RIPS is not limited to the common vulnerabilities though. Our sophisticated analysis engine is able to detect highly specific and very complex PHP vulnerabilities that are not found by any other product. Further vulnerability types include Cross-Site Scripting, Code Execution, Command Execution, Denial of Service, Directory Listing, Environment Manipulation, Execution After Redirect, File Create, File Delete, File Inclusion, File Upload, File System Manipulation, File Write, HTTP Response Splitting, Information Leakage, Library Injection, LDAP Injection, Log Forgery, Mass Assignment, Memcached Injection, MongoDB Injection, NoSQL Injection, Open Redirect, Path Traversal, PHP Object Injection/Instantiation, Reflection/Autoload Injection, Resource Injection, Server-Side JavaScript Injection, Server-Side Request Forgery, Session Fixation, SQL Injection, Variable Manipulation, Weak Cryptography, XML/XXE Injection, Xpath Injection, Xquery Injection, ...

  Real examples in our
Vulnerability Database

Stay current
about our latest features