It can be a good first order approximation if you don't wanna take the time to examine the code like by line looking for SQL injection opportunities or whatever