Framework of SQL Injection Attack

TL;DR

This paper presents a novel parser-based framework utilizing context-free grammars and compiler techniques to detect and prevent SQL Injection Attacks in web applications, enhancing database security.

Contribution

It introduces a SQLI Prevent Parser that analyzes query structures for equivalence, offering a dynamic and effective method to prevent SQL Injection Attacks.

Findings

Successfully applied on a sample web application

Positive results in detecting and preventing SQL Injection Attacks

Demonstrated effectiveness of parser-based approach

Abstract

With the changing demographics of globalization, the emergence and prevalence of web application have acquired a central and pivotal role in the domains of technology and advancements. It thus becomes imperative to probe deeply into the architecture, significance and different facets of usages. Web applications enclose the functioning between a user and the services provided by the server, which contains a database as its backend. The user can access the required information through sending a request in the form of text to the web server, which is interpreted by the server side script to construct an SQL. The query is sent to the database which responds in order to generate an HTML page that is sent back to the user. Since the functioning of web application is a dynamic and complicated matter, certain threats to the database security have been registered. One such alarming threat is the prevalence of SQL Injection Attack. Hence a dynamic algorithm is given in this paper for preventing SQL Injection Attacks which is based on context free grammars and compiler parsing techniques. The paper attempts to present the notation of a SQLI Prevent Parser for the prevention of SQL Injection Attacks. This Parser determines the structure of queries and compares whether the queries are functionally equivalent or not. This parser has been used on a sample web application and the results have come out to be positive majors to prevent SQL Injection Attacks.