1. A method for detecting vulnerable sites within a database application, the method comprising: constructing, within a memory of a computer system, a data flow graph that reflects data flow between the value-holders that are referred to in at least a portion of the code of the database application; automatically identifying, in the data flow graph, a set of command-formation nodes that correspond to value-holders whose values are used to form database commands that the database application may submit to a database server when the database application is executed; and generating output, based on the data flow graph and the identified set of command-formation nodes, for use in detecting vulnerable sites within the application.