Sciweavers

Share
EDO
2005
Springer

Using parse tree validation to prevent SQL injection attacks

10 years 9 months ago
Using parse tree validation to prevent SQL injection attacks
An SQL injection attack targets interactive web applications that employ database services. Such applications accept user input, such as form fields, and then include this input in database requests, typically SQL statements. In SQL injection, the attacker provides user input that results in a different database request than was intended by the application programmer. That is, the interpretation of the user input as part of a larger SQL statement, results in an SQL statement of a different form than originally intended. We describe a technique to prevent this kind of manipulation and hence eliminate SQL injection vulnerabilities. The technique is based on comparing, at run time, the parse tree of the SQL statement before inclusion of user input with that resulting after inclusion of input. Our solution is efficient, adding about 3 ms overhead to database query costs. In addition, it is easily adopted by application programmers, having the same syntactic structure as current popular...
Gregory Buehrer, Bruce W. Weide, Paolo A. G. Sivil
Added 27 Jun 2010
Updated 27 Jun 2010
Type Conference
Year 2005
Where EDO
Authors Gregory Buehrer, Bruce W. Weide, Paolo A. G. Sivilotti
Comments (0)
books