Попробуй RISP http://websec.wordpress.com/2010/06/11/rips-a-static-source-code-analyser-for-vulnerabilities-in-php-scripts/