A novel method for SQL injection attack detection based on removing SQL query attribute values

作者：Lee Inyong; Jeong Soonki; Yeo Sangsoo; Moon Jongsub^*

来源：Mathematical and Computer Modelling, 2012, 55(1-2): 58-68.

DOI：10.1016/j.mcm.2011.01.050

• SQL injection attack
• SQL query
• A combined dynamic and static method
• DBMS
• Web application

SQL injection or SQL insertion attack is a code injection technique that exploits a security vulnerability occurring in the database layer of an application and a service. This is most often found within web pages with dynamic content. This paper proposes a very simple and effective detection method for SQL injection attacks. The method removes the value of an SQL query attribute of web pages when parameters are submitted and then compares it with a predetermined one. This method uses combined static and dynamic analysis. The experiments show that the proposed method is very effective and simple than any other methods.

• 出版日期2012-1