I would work on the creation of a hybrid/crystal box tool using:

• PHP-Sat for the static analysis part or a Simple RegEx matcher
• My own black box tester

Actually, it's quite easy to combine:

# don't care about the false positive rate
If you find something with the static analyser :
   # <=> check for false positive  
    test the parameter/address with the black box tester. 

The result would be a serious decrease of the false-positive and hopefully an increase of the true-positive...