Netsparker: Free Web Application Security Program

It can detect SQL Injection and Cross-site Scripting (XSS) issues better than many other scanners (if not all), and it's completely FREE.