1. A system, comprising: at least one processor to: determine whether instructions executed by an application under testing include database instructions; if the instructions include database instructions: determine whether a first database instruction enters information into a database; determine whether a second database instruction obtains said information from the database; and if the first database instruction enters the information in the database and the second database instruction obtains the information therefrom, determine whether the application is vulnerable to entry of malicious code into the database via the first database instruction and execution of the malicious code via the second database instruction.