SQL injection attack mechanisms and prevention techniques

Authors:
Roshni Chandrashekhar;Manoj Mardithaya;Santhi Thilagam;Dipankar Saha
Affiliations:
Computer Engineering Department, National Institute of Technology Karnataka, Surathkal, India;Computer Engineering Department, National Institute of Technology Karnataka, Surathkal, India;Computer Engineering Department, National Institute of Technology Karnataka, Surathkal, India;Computer Engineering Department, National Institute of Technology Karnataka, Surathkal, India
Venue:
ADCONS'11 Proceedings of the 2011 international conference on Advanced Computing, Networking and Security
Year:
2011

Citing 13
Cited 0

SQL DOM: compile time checking of dynamic SQL statements

Proceedings of the 27th international conference on Software engineering
Context-sensitive program analysis as database queries

Proceedings of the twenty-fourth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
Combining static analysis and runtime monitoring to counter SQL-injection attacks

WODA '05 Proceedings of the third international workshop on Dynamic analysis
AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks

Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering
Using parse tree validation to prevent SQL injection attacks

SEM '05 Proceedings of the 5th international workshop on Software engineering and middleware
Application layer intrusion detection for SQL injection

Proceedings of the 44th annual Southeast regional conference
Improving software security with precise static and runtime analysis

Improving software security with precise static and runtime analysis
A Static Analysis Framework For Detecting SQL Injection Vulnerabilities

COMPSAC '07 Proceedings of the 31st Annual International Computer Software and Applications Conference - Volume 01
CANDID: preventing sql injection attacks using dynamic candidate evaluations

Proceedings of the 14th ACM conference on Computer and communications security
SQL-IDS: a specification-based approach for SQL-injection detection

Proceedings of the 2008 ACM symposium on Applied computing
Systematically Eradicating Data Injection Attacks Using Security-Oriented Program Transformations

ESSoS '09 Proceedings of the 1st International Symposium on Engineering Secure Software and Systems
Learning SQL for Database Intrusion Detection Using Context-Sensitive Modelling (Extended Abstract)

DIMVA '09 Proceedings of the 6th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Panacea: Automating Attack Classification for Anomaly-Based Network Intrusion Detection Systems

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

SQL Injection Attacks have been around for over a decade and yet most web applications being deployed today are vulnerable to it. The bottom line is that the web has made it easy for new developers to develop web applications without concerning themselves with the security flaws, and that SQL Injection is thought to be a simple problem with a very simple remedy. To truly bring security to the masses, we propose a classification that not only enumerates but also categorizes the various attack methodologies, and also the testing frameworks and prevention mechanisms. We intend our classification to help understand the state of the art on both sides of the fields to lay the groundwork for all future work in this area.