S. Yaswanthraj, M Abinaya, S Kavya et al. · International Journal of Research Publication and Reviews · 2024
SQL injection (SQLi) remains one of the most prevalent and damaging attack vectors targeting web applications today.This abstract explores the nature of SQL injection attacks, their potential impacts, and various prevention mechanisms to mitigate this security threat.SQL injection occurs when an attacker manipulates input fields of a web application to execute arbitrary SQL queries against the underlying database.Through these malicious queries, attackers can extract sensitive information, modify or delete data, and even gain unauthorized access to the entire database.The consequences of successful SQL injection attacks can range from data breaches and financial losses to reputational damage for affected organizations.To prevent SQL injection attacks, several defense mechanisms have been developed.These include input validation, parameterized queries, stored procedures, and the use of web application firewalls (wafs).Input validation involves thoroughly validating and sanitizing user input to ensure that only expected data is accepted by the application.
Cited by 1Open access
Huang Shao-yong · 2012
This article mainly discussed the principle,types,methods and protective measures of SQL injection attack.SQL injection attack is a long history of attacks,if we know how to avoid it,we can avoid it through by some methods of protective.
Cited by 0
Faye Satari · SSRN Electronic Journal · 2008
Cited by 0Open access
Arjun Thimmappa · 2018
ijseries.com is your first and best source for all of the information you’re looking for. From general topics to more of what you would expect to find here, ijseries.com has it all. We hope you find what you are searching for!
Cited by 1
Deng, Y. Y. · Репозиторий БГУИР (BSUIR Repository) · 2024
The paper discusses SQL injection, a common editing language used to inject malicious SQL commands into input forms or \nqueries in order to gain access to a database or manipulate its data. Corresponding precautions for each SQLI are considered.
Cited by 0Open access
Billah, MD. Minhazul, Zahir, Adnan-Bin, Tabassum, Syeda Lamia et al. · BRAC University Institutional Repository (BRAC University) · 2021
This thesis is submitted in partial fulfillment of the requirements for the degree of Bachelor of Science in Computer Science and Engineering, 2021.
Cited by 0Open access
Iosr Journals, Ashish John · Figshare · 2015
Cited by 3Open access
Iosr Journals, Ashish John · Figshare · 2015
Cited by 3Open access
Deng Yuanyuan · Репозиторий БГУИР (BSUIR Repository) · 2025
Cited by 0Open access
Atefeh Tajpour, Suhaimi Ibrahim, Maslin Masrom · International Journal of Advancements in Computing Technology · 2011
SQL injection is a type of attack which the attacker adds Structured Query Language code to a web form input box to gain access or make changes to data. SQL injection vulnerability allows an attacker to flow commands directly to a web application's underlying database and destroy functionality or confidentiality. Researchers have proposed different tools to detect and prevent this vulnerability. In this paper we present SQL injection attack types and also current techniques which can detect or prevent these attacks. Finally we evaluate these techniques.
Cited by 33
Shahbaaz Mohammed Hayat Chaki, Mazura Mat Din, Maheyzah Md Siraj · International Journal of Innovative Computing · 2019
In everybody’s life including the organisations, database plays a very important role, since today everything is connected via the Internet. There is a need for a database that helps organisations to organise, sort and manage the data and ensure that the data a user receives and sends via the database mean is secure, since the database stores almost everything such as banking details including user ID and password. Make this data really valuable and confidential for us and therefore security is really important for the database. In this age, SQL Injection database attacks are increasingly common. The hackers attempt to steal an individual’s valuable data through the SQL Injection Attack mean by using malicious query on the application, hence revealing an efficient individual data. Therefore the best SQL Injection Prevention technique is needed to safeguard individual data against hackers being stolen. This paper compares two types of SQL Injection using the SQL pattern matching database system attack (SQLPMDS) and a SQL injection union query attacks prevention using tokenisation technique (SIUQAPTT) that allows Database Administrator to select the best and most effective SQL Injection Prevention method for their organisation. Preventing SQL Injection Attack from occurring that would ultimately lead to no user data loss. The results were obtained by comparing it to the results of the SQL injection attack query on whether the attack was blocked or not by two prevention techniques, SQL pattern matching database system attacks and SQL injecting union query attacks prevention using website tokenisation techniques. The conclusion is that the best method of prevention is the SQL pattern that matches database system attacks.
Cited by 0Open access
Jagdish Halde · 2008
Web sites are dynamic, static, and most of the time a combination of both. Web sites need protection in their database to assure security. An SQL injection attacks interactive web applications that provide database services. These applications take user inputs and use them to create an SQL query at run time. In an SQL injection attack, an attacker might insert a malicious SQL query as input to perform an unauthorized database operation. Using SQL injection attacks, an attacker can retrieve or modify confidential and sensitive information from the database. It may jeopardize the confidentiality and security of Web sites which totally depends on databases. This report presents a “code reengineering” that implicitly protects the applications which are written in PHP from SQL injection attacks. It uses an original approach that combines static as well as dynamic analysis. [2] In this report, I mentioned an automated technique for moving out SQL injection vulnerabilities from Java code by converting plain text inputs received from users into prepared statements. [3]
Cited by 5Open access
Fairoz Q. Kareem, Siddeeq Y. Ameen, Azar Abid Salih et al. · Asian Journal of Research in Computer Science · 2021
The vulnerabilities in most web applications enable hackers to gain access to confidential and private information. Structured query injection poses a significant threat to web applications and is one of the most common and widely used information theft mechanisms. Where hackers benefit from errors in the design of systems or existing gaps by not filtering the user's input for some special characters and symbols contained within the structural query sentences or the quality of the information is not checked, whether it is text or numerical, which causes unpredictability of the outcome of its implementation. In this paper, we review PHP techniques and other techniques for protecting SQL from the injection, methods for detecting SQL attacks, types of SQL injection, causes of SQL injection via getting and Post, and prevention technology for SQL vulnerabilities.
Cited by 33Open access
Haripriya Rana, Shelly Sachdeva · Indian Journal of Science and Technology · 2017
Objectives: SQL Injection Attack (SQLIA) is a frequent and a severe security issue in the web applications. In SQLIA, hacker can obtain the benefit of poor input validation and weak coded web application. Due to the successful execution of a SQLIA, integrity and confidentiality of data are lost which results in the degrading organization’s market value. This paper gives a valuable analysis of various types of SQLIAs, methods and mechanisms. It also explores various detection and prevention techniques. Methods/Analysis: A rigorous survey has been conducted and consequently, comparative analysis of various detection and prevention techniques is done with respect to various types of attacks. In current research various pattern matching algorithms for the detection and prevention of SQLIA are analyzed and few are tested. Findings: Comparative analysis of Boyer Moore pattern matching algorithm is done with Naive String pattern matching algorithm. The time and memory consumption taken by both the algorithms has been analyzed. The results show that Boyer Moore is more efficient to detect and prevent the SQLIAs as compared to Naive string. Novelty/Improvement: In future it aims to propose an algorithm which will enhance in terms of efficiency and resource usage. The approach needs to be implemented for every pattern matching algorithm to find the best solution regarding detection and prevention of SQLIA. Keywords: Boyer Moore Algorithm, Detection, Prevention, SQLIA, SQL Injection
Cited by 6Open access
Ramakanth Dorai, Vinodkannan Arumugam, Logashkumar Veerabadran et al. · 2010
Abstract. SQL injection came with a bang and caused revolution in database attacking. In recent years, with the explosion in web-based commerce and information systems, databases have been drawing ever closer to the network and it is critical part of network security. This paper is incorporated with our research and firsthand experience in hacking the database by SQL injection. Database is the Storage Brain of a website. A hacked database is the source for Passwords and juicy information like credit card number, bank account number and every important thing that are forbidden. Importance should be given for preventing database exploitation by SQL injection. The aim of this paper is to create awareness among web developers or database administrators about the urgent need for database security. Our ultimate objective is to totally eradicate the whole concept of SQL injection and to avoid this technique becoming a plaything in hands of exploiters. 1.
Cited by 15
Prof. Kavita Meshram · International Journal for Research in Applied Science and Engineering Technology · 2025
With the world's fast evolving digital environment, web applications are at the centre of action in all industries like ecommerce, finance, healthcare, and education. With their increasing complexity and size, they are also open to enhanced cyber threats. One of the most stubborn and destructive among them is SQL Injection (SQLi), which involves attackers leveraging flaws in an application's database interaction layer to inject malicious SQL code through user inputs. It has serious repercussions, ranging from unauthorized access to data, loss or corruption of data, and total control of the backend database server. This project seeks to develop and deploy a complete, real-time SQL Injection detection and alert system that counters these attacks through a multi-layered security model. The solution proposed uses both proactive and reactive defence systems to provide strong protection. Proactive techniques involve input sanitization, parameterized queries, and web application firewalls to stop malicious input from being sent to the database. Concurrently, the reactive part entails real-time SQL query monitoring with machine learning techniques and pattern matching to identify anomalous or suspicious activity pointing to SQLi attempts. Once a threat is identified, the system promptly alerts administrators and activates automated containment processes to contain damage and avoid escalation. This comprises blocking suspect IP addresses, closing affected sessions, and logging events for analysis. By combining multiple defence layers and focusing on real-time detection and response, this system not only mitigates existing SQLi attack vectors but is also responsive to changing threat patterns. Overall, the proposed framework strengthens the security posture of web applications as a whole and ensures the confidentiality, integrity, and availability of sensitive data in an ever-connected digital space.
Cited by 0Open access
Gülsüm Yiğit, Merve Arnavutoğlu · International Journal of Computer Theory and Engineering · 2017
SQL Injection Attack (SQLIA) is a type of code injection technique that threatens confidentiality, integrity, and availability of web databases. The attacker mostly exploits incorrectly filtered user inputs such as text fields in web applications and tries to insert malicious SQL statements into a legitimate query via the vulnerable user input. By doing so, the attacker can access, insert, modify, or delete critical information in a database without proper authorization. In this survey, we describe and categorize types of SQLIA, and analyze existing detection and prevention techniques against such attacks.
Cited by 13Open access
Gaurav Shrivastava, Kshitij Pathak · International Journal of Computer Applications · 2013
In today's era where almost every task is performed through web applications, the need to assure the security of web applications has increased. A survey held in 2010 shows web application vulnerabilities and SQL Injection attack ranked among top five SQL Injection attack (SQLIA) is performed by those persons who want to access the database and want to steal, change or delete the data which they do not have permission to access In SQLIA adversary requests through a malicious query which shows some confidential data In research, it is also proved that when a network and host-level entry point is highly secured, the public interface provided by an application is the one and only source of SQL injection attack. SQLIA can't be applied without using space, single quotes or double dashes So to prevent SQLIA, these options are taken in observation. Previous model [10] used JDBC-LDAP library which did not support instances, alias and set operations (UNION and UNION ALL). If a query with injection is accepted by any database which is based on relational approach, then it will be accepted by all databases that are based on relational approach. This paper is focused on SQLIA and its techniques and encounters the shortcoming of previous models. This paper proposed a model which uses two databases one relational and other hierarchical to ensure about injection in a query, compare the results by applying tokenization technique on both databases. If the results are same, there is no injection, otherwise it is present. The proposed model uses a tokenization technique so; query containing Alias, Instances and Set operations can also be blocked at the entry point.
Cited by 11Open access
Atefeh Tajpour, Mohammad Heydari, Maslin Masrom et al. · 2010
SQL Injection Attacks (SQLIAs) is one of the most serious threats to the security of database driven applications. In fact, it allows an attacker to gain control over the database of an application and consequently, an attacker may be able to alter data. Many surveys have addressed this problem. Also some researchers have proposed different approaches to detect and prevent this vulnerability but they are not successful completely. Moreover, some of these approaches have not implemented yet and users would be confused in choosing an appropriate tool. In this paper we present all SQL injection attack types and also different tools which can detect or prevent these attacks. Finally we assessed addressing all SQL injection attacks type among current tools.
Cited by 44
Roshni Chandrashekhar, Manoj Mardithaya, P. Santhi Thilagam et al. · Lecture notes in computer science · 2012
Cited by 18