9. A method for static analysis, comprising: receiving string information comprising program code as input; parsing the string information to produce one or more string components using a processor; determining string components that may be represented concretely by comparing the one or more components to a set of known concretizations, wherein the set of known concretizations includes string configurations that cannot be interfered with by an attacker; abstracting all string components that could not be represented concretely; creating a hybrid string representation that includes at least one concrete string component and at least one abstracted string component; and performing a taint analysis on the hybrid string representation to locate potential vulnerabilities.
9. A method for static analysis, comprising: receiving string information comprising program code as input; parsing the string information to produce one or more string components using a processor; determining string components that may be represented concretely by comparing the one or more components to a set of known concretizations, wherein the set of known concretizations includes string configurations that cannot be interfered with by an attacker; abstracting all string components that could not be represented concretely; creating a hybrid string representation that includes at least one concrete string component and at least one abstracted string component; and performing a taint analysis on the hybrid string representation to locate potential vulnerabilities. 16. The method of claim 9 , wherein the string information comprises a combination of program code and markup code.