Application code has dozens of static analyzers, SQL has almost nothing, here's what exists.