# Application for testing security?

**URL:** <https://www.phphelp.com/t/application-for-testing-security/21132>\
**Category:** Security and PHP\
**Created:** [September 19, 2013, 8:28pm UTC](https://www.phphelp.com/t/application-for-testing-security/21132 "2013-09-19T20:28:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sensimillia](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/57b2e6/32.png) [@Sensimillia](https://www.phphelp.com/u/Sensimillia)\
**Post date:** [September 19, 2013, 8:28pm UTC](https://www.phphelp.com/t/application-for-testing-security/21132/1 "2013-09-19T20:28:43Z")

</div>

Does anyone know of a program (preferably online) that I can point at my website and test it for SQL injections, XSS attacks, anti-automated input, session hijacking, ect?

---

<div class="post-metadata">

**Author:** ![JimL](https://www.phphelp.com/user_avatar/www.phphelp.com/jiml/32/1842_2.png) [@JimL](https://www.phphelp.com/u/JimL)\
**Post date:** [September 19, 2013, 8:34pm UTC](https://www.phphelp.com/t/application-for-testing-security/21132/2 "2013-09-19T20:34:40Z")

</div>

An application will not be able to catch all so it’s much better checking this yourself. Having an application doing a full site sqli/xss scan with all vectors will take ages.

If you are using parameterized queries and escaping all data in templates/views there should be no problems.

SQLi: look for queries with variables in them, and remove the variables as they are a security risk.  
XSS: escape all data on output. Remember to be very strict when outputting data into javascript.

For searches you could use Acunetix or Nessus, or any of the other tools made for this. You’ll find dozens on Google 🙂

---

<div class="post-metadata">

**Author:** ![phphelp](https://www.phphelp.com/letter_avatar_proxy/v4/letter/p/3ec8ea/32.png) [@phphelp](https://www.phphelp.com/u/phphelp)\
**Post date:** [September 20, 2013, 1:31am UTC](https://www.phphelp.com/t/application-for-testing-security/21132/3 "2013-09-20T01:31:19Z")

</div>

Qualsys, has a free online scanner, but I never used it…

> **[Qualys FreeScan - Free Vulnerability Scanner | Qualys, Inc.](https://www.qualys.com/forms/freescan/)**
>
> FreeScan accurately scans your network, servers, desktops or web apps for security vulnerabilities — and lets you know instantly where you’re at risk.