Static Transformation : Derivation trees before and after transformation

TAPS dumps .dot files for derivation trees after symbolic evaluation (shown in the left pane) and after introducing placeholder (?) nodes in them (shown in the right pane). The images shown below are generated from the .dot files, using the dot command.

The derivation tree of test1 after symbolic evaluation and after introducing placeholders is shown below. The line numbers correspond to the file webExample.php generated from the web supplied source code to be transformed. The code of test1 is given below for quick reference.

line26: $a = $_GET['user'];
line27: $query = "delete from test1 where u = '".$a."'";
line28: @mysql_query($query);