hi frankblack.

it is not easy to find security holes in some modules automatically, I think.

For example, although we know that the vulnerablity of SQL Injection is caused by forgot sanitizing requests, We can't make the forgot pattern in the php codes easily.

On the other hand, protecting SQL Injection is not so difficult.
Because It is enough to check all requests before parsing common.php.

Thus, I recommend "Xoops Protector" to all XOOPSers with confidence.