Research on SQL Injection Vulnerabilities and Its Detection Methods

Abstract

SQL injection is a typical kind of Web vulnerability, and it is also the most common method used by attackers to attack databases. Attackers usually detect and use this vulnerability to access the back-end database of target website, and illegally obtain confidential information in the database through a series of injection methods, thereby causing unpredictable damage and loss. This paper studies the attack principle, detection technologies and preventive measures of SQL injection, and proposes an approach and a tool named SQLIiscan. The tool is tested by detecting a popular project WAVSEP1.5 which includes many test cases of different vulnerabilities, and the test results show that it can detect SQL injection cases efficiently and accurately.