Detecting and Fixing SQL Injection and Cross-Site Scripting Vulnerabilities in Web Applications

More people have access to the internet than ever before. This has prompted many organizations to develop web-based applications that users can use online to interact with the organization. Poorly written code for web applications, especially SQL queries can be exploited to gain unauthorized access to sensitive data and web servers. It is not possible to manually scroll through the codebase to detect parts of code that would make the application vulnerable to attacks. Thus, machine learning and natural language processing-based solutions would help detect such queries either based on their patterns or signatures or through training via previous attack datasets. This paper aims to propose a novel methodology to detect SQL injection vulnerable queries and Cross-Site Scripting (XSS) attacks using pattern matching and NLP techniques and rewrite or in other words correct the vulnerable parts of code to prevent such attacks. Overall, this paper is used to identify vulnerable parts of code in a given client-side PHP web application, detect if the vulnerability belongs to a particular attack type and finally correct the vulnerable section of the code by providing recommendations based on standard prevention techniques for the corresponding attacks.