Securing web applications against SQL injection attacks - A Parameterised Query perspective)

Abstract

SQL Injection attack is a major threat to web applications and source of concerns to e-commerce in particular. The attack bypasses major security measures to execute malicious SQL codes and have absolute control of the database server behind the web application. Going by millions of dollars being spent yearly by various organizations to guide against the attack, it is imperative to have a better understanding of how SQL Injection works and how best it could be prevented. Using an e-commerce application as a case study, this paper demonstrates how Parameterized Queries could be used to defend SQL Injection attacks. With prepared statements in Java where LoginController was employed as the Servlet to control the application login procedure, Parameterized Queries were successfully incorporated into an e-commerce application. The implementation results shows that SQL injection is no longer possible as every code from attackers could not be executed because input was set to be data and data would be treated differently from codes.