> And finally, these tools do still generate false positives. And as long as we talk about tools that do some kind of semantic analysis (not just syntactic) on

> And finally, these tools do still generate false positives. And as long as we talk about tools that do some kind of semantic analysis (not just syntactic) on a turing-complete language they will always either have false positives, false negatives or both. Rice's theorem guarantees that. They still can be useful though. I programmed a static analysis tool for PHP a long time ago and it worked surprisingly well.