Finding SQL injection vulnerabilities in web applications