A Survey Of Sql Injection Countermeasures <s> Combining Static Analysis and Runtime Analysis <s> Many data-intensive applications dynamically construct queries in response to client requests and execute them. Java servlets, e.g., can create string representations of SQL queries and then send the queries, using JDBC, to a database server for execution. The servlet programmer enjoys static checking via Java's strong type system. However, the Java type system does little to check for possible errors in the dynamically generated SQL query strings. Thus, a type error in a generated selection query (e.g., comparing a string attribute with an integer) can result in an SQL runtime exception. Currently, such defects must be rooted out through careful testing, or (worse) might be found by customers at runtime. In this paper, we present a sound, static, program analysis technique to verify the correctness of dynamically generated query strings. We describe our analysis technique and provide soundness results for our static analysis algorithm. We also describe the details of a prototype tool based on the algorithm and present several illustrative defects found in senior software-engineering student-team projects, online tutorial examples, and a real-world purchase order system written by one of the authors. <s> BIB001 </s> A Survey Of Sql Injection Countermeasures <s> Combining Static Analysis and Runtime Analysis <s> AMNESIA is a tool that detects and prevents SQL injection attacks by combining static analysis and runtime monitoring. Empirical evaluation has shown that AMNESIA is both effective and efficient against SQL injection. <s> BIB002 </s> A Survey Of Sql Injection Countermeasures <s> Combining Static Analysis and Runtime Analysis <s> Vulnerabilities in web applications allow malicious users to obtain unrestricted access to private and confidential information. SQL injection attacks rank at the top of the list of threats directed at any database-driven application written for the Web. An attacker can take advantages of web application programming security flaws and pass unexpected malicious SQL statements through a web application for execution by the back-end database. This paper proposes a novel specification-based methodology for the detection of exploitations of SQL injection vulnerabilities. The new approach on the one hand utilizes specifications that define the intended syntactic structure of SQL queries that are produced and executed by the web application and on the other hand monitors the application for executing queries that are in violation of the specification. The three most important advantages of the new approach against existing analogous mechanisms are that, first, it prevents all forms of SQL injection attacks; second, its effectiveness is independent of any particular target system, application environment, or DBMS; and, third, there is no need to modify the source code of existing web applications to apply the new protection scheme to them. We developed a prototype SQL injection detection system (SQL-IDS) that implements the proposed algorithm. The system monitors Java-based applications and detects SQL injection attacks in real time. We report some preliminary experimental results over several SQL injection attacks that show that the proposed query-specific detection allows the system to perform focused analysis at negligible computational overhead without producing false positives or false negatives. Therefore, the new approach is very efficient in practice. <s> BIB003
Halfond and Orso  proposed a technique called AMNESIA to handle SQL injection problems by combining static analysis and runtime monitoring techniques. In its static phase, AMNESIA first finds all the hotspots in the application code. Hotspots are the points in a program where SQL queries are issued. Then AMNESIA builds a character-level NonDeterministic Finite Automaton (NDFA) model for each hotspot by using the Java string analysis technique similar to the one used in BIB001 . The character-level model is further analyzed to group characters into SQL tokens and string tokens. A SQL token is a SQL keyword, a delimiter or an operator. A string token could be a hard-coded string written by programmers or a user submitted value  . Figure 8 shows an example SQL query model that represents two queries at a hotspot. To counter SQL injection attacks, a call to a monitor is added into the program at each hotspot. A monitor is used to check the queries at runtime BIB002 . In the dynamic phase, the monitor will be invoked if a hotspot receives values. Then the monitor will parse the runtime generated SQL query into tokens and delimiters  . To find if the SQL query is legitimate, AMNESIA simply needs to check the parsed query against the corresponding SQL query model. If the model accepts the query, the monitor will consider it as a valid query and then pass it to the back-end database. For example, the following query will be accepted by the model using the first branch shown in Figure 8 : SELECT info FROM users WHERE login = 'guest'; But if we feed another query SELECT info FROM users WHERE login = 'anyname' or 1=1 --'and pass = ' anypwd'; into the model, it will not be able to reach the final accept state because the token OR does not match the token AND in the model. If the query does not match the model, the monitor will abort it and report the attack information, which will help developers to design appropriate ways to handle the attacks according to their specific needs  . For example, the information can be added into the pool of attack patterns and used by an intrusion detection system.The accuracy of the static analysis results would affect the performance of AMNESIA. For example, if the static analysis creates imprecise models, AMNESIA could raise a false alarm when a legitimate query comes in or fail to detect some SQL injection attacks  . In addition, the technique requires adding codes into the application programs to call the monitor. That could add extra burdens to developers BIB003 .