9. A system for detecting vulnerabilities in a software application operating in a database system, comprising: a processor; and memory storing one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: storing defined vulnerabilities that identify operations in the software application vulnerable to the security risk and are each associated with one or more input tags and one or more sanitization tags; assigning the one or more of the input tags to objects returned by input methods in the software application, wherein the input tags identify the objects as potentially malicious and security risks; assigning the one or more of the sanitization tags to the one or more objects associated with the request, wherein the sanitization tags identify security checks performed on the objects; comparing the input tags assigned to the objects with the sanitization tags assigned to the objects; identifying at least one of the defined vulnerabilities as a vulnerability in a part of the software application when the assigned input tag for an identified one of the objects matches the input tag associated with an identified one of the defined vulnerabilities, and one or more of the sanitization tags associated with the identified one of the defined vulnerabilities is not an assigned sanitization tag for the identified one of the objects; and generating a report identifying the vulnerability in a part of the software application.
14. The system of claim 9 , wherein the instructions further cause the processor to carry out the steps of adding bytecode to the software application, wherein the bytecode assigns the input tags, assigns the sanitization tags, compares the input tags with the sanitization tags, and identifies the vulnerability in a part of the software application.