A Survey Of Sql Injection Countermeasures <s> Static Analysis Approach <s> An SQL injection attack targets interactive web applications that employ database services. Such applications accept user input, such as form fields, and then include this input in database requests, typically SQL statements. In SQL injection, the attacker provides user input that results in a different database request than was intended by the application programmer. That is, the interpretation of the user input as part of a larger SQL statement, results in an SQL statement of a different form than originally intended. We describe a technique to prevent this kind of manipulation and hence eliminate SQL injection vulnerabilities. The technique is based on comparing, at run time, the parse tree of the SQL statement before inclusion of user input with that resulting after inclusion of input. Our solution is efficient, adding about 3 ms overhead to database query costs. In addition, it is easily adopted by application programmers, having the same syntactic structure as current popular record set retrieval methods. For empirical analysis, we provide a case study of our solution in J2EE. We implement our solution in a simple static Java class, and show its effectiveness and scalability. <s> BIB001 </s> A Survey Of Sql Injection Countermeasures <s> Static Analysis Approach <s> Vulnerabilities in web applications allow malicious users to obtain unrestricted access to private and confidential information. SQL injection attacks rank at the top of the list of threats directed at any database-driven application written for the Web. An attacker can take advantages of web application programming security flaws and pass unexpected malicious SQL statements through a web application for execution by the back-end database. This paper proposes a novel specification-based methodology for the detection of exploitations of SQL injection vulnerabilities. The new approach on the one hand utilizes specifications that define the intended syntactic structure of SQL queries that are produced and executed by the web application and on the other hand monitors the application for executing queries that are in violation of the specification. The three most important advantages of the new approach against existing analogous mechanisms are that, first, it prevents all forms of SQL injection attacks; second, its effectiveness is independent of any particular target system, application environment, or DBMS; and, third, there is no need to modify the source code of existing web applications to apply the new protection scheme to them. We developed a prototype SQL injection detection system (SQL-IDS) that implements the proposed algorithm. The system monitors Java-based applications and detects SQL injection attacks in real time. We report some preliminary experimental results over several SQL injection attacks that show that the proposed query-specific detection allows the system to perform focused analysis at negligible computational overhead without producing false positives or false negatives. Therefore, the new approach is very efficient in practice. <s> BIB002
Static analysis can help programmers detect vulnerabilities they have overlooked and optimize codes. Although it is best used in the application development and debugging phase, it can also be used for protecting existing applications and programs. Developers can use static analysis to find bugs in programs so that they can modify source code or make patches for the applications. However, it could be tedious and time-consuming to patch a deployed system. In addition, static analysis often fails to detect all kinds of vulnerabilities so that it is easy to get high false negative rate BIB002 . What's more, static analysis can only identify the information available at compile time. In some cases, static analysis cannot capture the exact structure of an intended query because the full structure is only known at runtime BIB001 . For example, a web application ofa bookstore allows users to search books and can display the result in the order that is specified by users. The search result can be sorted by any of the columns such as the author's name and publication date by using an ORDER BY clause in the query. At compile time, it is impossible to know if or not the clause will be present in the query, because if a user does not want a sorted result he may just ignore the "Order by" options on the webpage. If the ORDER BY clause is used, it is still impossible to know the exact query statement at compile time because what column users will choose to sort results remains unknown until the runtime.