Securing web application code by static analysis and runtime protection