An Efficient Technique for SQL Injection Detection and Prevention

Abstract

With the recent rapid increase of interactive web applications that employ back-end database services, a SQL injection attack has become one of the most serious security threats. This type of attack can compromise confidentiality and integrity of information and database. Actually, an attacker intrudes to the web application database and consequently, access to data. For preventing this type of attack different techniques have been proposed by researchers but they are not enough because most of implemented techniques cannot stop all type of attacks. In this paper our proposed technique are detection of SQL injection and prevention based on first order, second order and blind SQL injection attacks online. The proposed technique implemented in JAVA and evaluated for seven types of SQL injection attacks. Experimental results have shown that the proposed technique is efficient related to execution time overhead. Our technique need to be one second overhead to execution time. Moreover, we have compared the proposed technique with the popular web application vulnerabilities scanner techniques. The most advantages of proposed technique Its easiness to adopt by software developer, having the same syntactic structure as current popular record set retrieval methods.