A Survey on Detection and Prevention Techniques for SQL Injection Attacks

Published Online November 2016 in MECS

Available online at

Web application are using for storing and retrieval for information. Various organizations use these applications for communication purpose for increasing their business and users stores there sensitive information in database. These web applications are developed in scripting languages and communication made with database through SQL queries. SQL is a communication medium between Web application and back end database. An attacker may harm the Database. So the attackers can use SQL for of breaking confidentiality purpose of database by accessing it. A SQL injection attack (SQLIA) is that in which a malicious mind person injects its own crafted query as input. The vulnerability exists within web application when a Web application does not provide proper validation or filtering for the input data entered by the user in the Input fields. The backend server executes the query statement and sends the result to the attackers. An attacker obtains the result. This SQL Injection Attack mostly affects financial web applications or secret information.

• * Corresponding author.

The WebSSARI [35] tool uses predefined set of filters for filtering inputs for finding security vulnerabilities in the application. This is quite useful because it can detect stored procedure with other SQLIAs. Another approach is SQLRand [32] which is based on a randomization query algorithms. Here a strong random integer is inserted in the SQL keywords. In SQL DOM a set of classes that are strongly typed to a database schema are used to generate SQL statements instead of string manipulation.

SQL CHECK [25] is based on a key inserted at both beginning and end of user’s input and invalid syntactic forms are the attacks.

SQLGAURD [30] proposed a model of expected queries at runtime. In this approaches, the model is expressed as a grammar that only accepts legal queries. Static analysis algorithm is derived from type system and type state for a secure information flow. At the time of analysis codes checks for any vulnerability without user intervention.

In the figures two processes are showing in figure 1 showing that how a normal user is accessing a web application. Here user wants to access his bank account by online banking system.

Fig.1. Normal User input in Web application et al [12]

For accessing following steps are required.

• 1.    Normal User by using web browser uses a web application of a bank and give username and password.

• 2.    After submission of input firewall checks formatting of given input.

• 3.    Now Application server checks the input field is in correct or not.

• 4.  This input converts into query form and transfer to the database server for checking authorization.

• 5.  When database check that the user is authorised so now execute the query and generates the result.

Fig.2. Process of Malicious User input in Web application et al [12]

This figure is showing SQL injection attack.

• 1.    Attacker insert fake input commands in username, in case of above figure it is OR 1=1—this is command for Tautology attack, which means all inputs are true and upcoming conditions will be executes.

• 2.    Tautology command gets the authorization for execution of query.

• 3.  Application server passes this query to the database server for execution.

• 4.  Database server generates the result of query after execution and shows to the attacker.

• 2.    Causes of Sql Injection Attacks

• 3.    Conclusion

Table 1. List of various causes by which SQL injection become Attacked.

Table 2. List of Various Types of SQL injection Attacks with the basic commands which uses for SQLIA et al [10, 12, 17]

Name of Attacks Basic commands Example of Malicious query Tautologies Statement “1=1” "SELECT * FROM the employee WHERE username = 'Harish' and password ='aaa' OR '1'='1'" Illegal /Logically Incorrect Queries An attacker may get the various parameters from errors message which generates on wrong query. So these parameters may help for creating new Query URL is original but in place type '3) Union Query In this type of attacker join a new query in original query by using UNION keyword and can get data tables from database. SELECT Name, Phone FROM Users WHERE Id=1 UNION ALL    SELECT    creditCardNumber,1    FROM CreditCardTable Blind Injection Attacker can get the information of database structure by asking true/false type of questions through SQL statements, when developers hide the error details. SELECT name FROM table WHERE login id= 'harish’ and 1 =0 -- AND pass = SELECT name FROM table WHERE login id= 'harish' and 1 = 1 -- AND pass = Timing Attacks WAITFOR keyword is used for delay response by database declare @ varchar(800) select @ = db_nameO if (ascii(substring(@, 1, 1)) & ( power(3, 0))) > 0 waitfor delay '0:0:15' Piggy-backed Queries It uses “;” to append crafted query to original query SELECT info FROM users WHERE login='doe' AND pass=”; drop table users—’AND pin =234 Stored Procedure It coded by programmer it can also be uses as attack. Depend on specific stored procedure on the database there are different ways to attack. CREATE PROCEDURE Authenticated @userName varchar2, @pass varchar2, @pin int AS EXEC("SELECT accounts FROM users WHERE login=’" +@userName+ "’ and pass=’" +@password+ "’ and pin=" +@pin); GO

Table 3. A Comparison between different tools and used methodology.

SQL injection attack is a major attack for security of web applications. For security of web application many tools have been developed for detection and prevention. In these most of the tools can attack some types of SQLIAs. Tautology checker, SQL DOM [26] SQLRand [32] CSSE [24], SQL Check [25] SQLGaurd [28] etc. are the tools which can detect Attacks but not all. Stored procedure is one type which can detect by only one tool that is WebSSARI [35]. VAIT [4] tool is new one which tested on only three open sources applications. But it need more test cases for improvements. Security of web application by SQLIA is an area where a tool requires by which all types of attacks may detect and prevent.