Web Application Analysis Tools?

["David Simcik" <dave () simcik com>]

Where I work, we've (read: I) have spent a considerable amount of time
focusing in on locking-down our sites/servers on the system level, from say,
IIS down, through a variety of ways. I should point out that we're a small
web development shop in academia. I'd now like to focus on our web
application source now as well. Are there any analysis/auditing tools out
there (especially free/inexpensive ones) that will help with this? I suspect
there aren't any "one size fits all" type solutions out there for this, but
I have to try.

Thanks!
David