Research of SQL injection attack and prevention technology

SQL injection attack is one of the most serious security vulnerabilities in Web application system, most of these vulnerabilities are caused by lack of input validation and SQL parameters use. Typical SQL injection attack and prevention technologies are introduced in the paper. The detecting methods not only validate user input, but also use type-safe SQL parameters. SQL injection defense model is established according to the detection processes, which is effective against SQL injection vulnerabilities.

I. Introduction

SQL injection was an attack in which malicious code was embedded in strings that were later passed to database backend for parsing and execution. The malicious data produced database query results and acquired sensitive information, such as account credentials or internal business data [1]. At present, the standard definition of SQL injection technique was not yet fully established. Chris Anley discussed the various ways in which SQL could be injected into the application and resolved some of the data validation and database lockdown issues [2]. Because most web applications were associated with database backend, there were possibilities of SQL injection attacks on its [3]. Through analyzing the principle of SQL injection attacks, prevention method was proposed to solve the double defense through the browser and server ends [4]. Jang exhibited a novel scheme that automatically transformed web applications, rendering them safe against SQL injection attacks [5].