I guess you won't be able to really find all possible exploits by parsing your source files.
also if there are really great lists provided in here, you can miss a function which can be exploitet
there still could be "hidden" evil code like this
$myEvilRegex = base64_decode('Ly4qL2U=');
preg_replace($myEvilRegex, $_POST['code']);
you could now say, i simply extend my script to also match this
but then you will have that mayn "possibly evil code" which additionally is out of it's context
so to be (pseudo-)secure, you should really write good code and read all existing code yourself
