RIPS is the most popular static code analysis tool to automatically detect vulnerabilities in PHP applications. By tokenizing and parsing all source code files, RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by userinput (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities, RIPS offers an integrated code audit framework.

NOTE: RIPS 0.5 development is abandoned since 2013 due to its fundamental limitations.
A complete rebuilt solution is available from RIPS Technologies that overcomes these limitations and performs state-of-the-art security analysis.

Compared Feature RIPS 0.5 Next Generation

Supported PHP LanguagePHP 3-4, no OOPall, PHP 3-7

Static Code AnalysisOnly Token-basedState-of-the-art

Analysis PrecisionLowVery High

PHP Version Specific AnalysisNoYes

Scales to Large CodesizesNoYes

API / CLI SupportNoYes

Continuous IntegrationNoYes

Compliance / StandardsNoYes

Store Analysis ResultsNoYes

Export Analysis ResultsNoYes

Issue Review SystemNoYes

Realtime ResultsNoYes

Vulnerability TrendsNoYes

Detects Latest RisksNoYes

Detects Code Quality IssuesNoYes

Detects MisconfigurationsNoYes

Detects Complex VulnerabilitiesLimitedYes

Supported Issue Types15>200

SpeedFastFast

Get the next generation