Impact of SQL Injection in Database Security

Gupta, Himanshu; Mondal, Subhash; Ray, Srayan; Giri, Biswajit; Majumdar, Rana; Mishra, Ved Prakash

doi:10.1109/iccike47802.2019.9004430

Cited by 8 publications

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The prevention from this injection has become the focus of database administrators, network administrators, application code programmers, database system providers, software developers and the top management of the organization. The problems brought by SQL injection have been around for a long time and are still a hot topic in information security issues [4] [5]. Web application security and database security are inter-dependent.…”

Section: Introductionmentioning

confidence: 99%

A Method to Prevent SQL Injection Attack using an Improved Parameterized Stored Procedure

Ahmad¹,

Karim²

2021

IJACSA

View full text Add to dashboard Cite

Structured Query Language (SQL) injection is one of the critical threats to database security. The effects of SQL injection attacks cause the data contained in the database to be at risk of being exploited by irresponsible parties, compromising data integrity, disrupting server operations and in return affecting the organization's image. Although SQL injection is an attack performed at the application level, SQL injection prevention requires security controls at all levels, namely application level, database level and network level. The absence of SQL injection prevention measures at the application level makes the database vulnerable to attack. Reviews indicate that the current approaches still not sufficient in addressing these three issues, which are i) improper use of dynamic SQL, ii) lack of input validation process and iii) inconsistent error handling. Currently, program and database code security is based solely on basic security measures that are focused at the network level such as network firewalls, database access control and web server request filtering. Unfortunately, these measures are still inadequate and not sufficient to safe guard the program code and databases from the attack. To overcome this shortcoming as addressed by these three issues, a new comprehensive method is proposed using an improved parameterized stored procedure to enhance database security. Experimental results prove that the proposed method is able to prevent SQL injection from occurring and able to shorten the processing time when compared with existing methods, hence able to improve database security.

show abstract

Section: Introductionmentioning

confidence: 99%