Use of Query Tokenization to Detect and Prevent SQL Injection Attacks

Anurekh Kumar; Shobha Bhatt

CALL FOR PAPERS : Mar-2023

Submission Last Date

25-Mar-23

Submit Manuscript Online

FOR AUTHORS

FOR REVIEWERS

ARCHIEVES

DOWNLOADS

Open Access

Use of Query Tokenization to Detect and Prevent SQL Injection Attacks

Author(s):

Anurekh Kumar , AIACTR; Shobha Bhatt, AIACTR

Keywords:

SQLIA, Classification of SQLIA, Query Tokenization, SQL injection, SQL detection etc

Abstract:

In today’s era where almost every task is performed through web applications, the need to assure the security of web applications has increased. A survey held in 2010 shows web application vulnerabilities and SQL Injection attack ranked among top five. SQL Injection attack (SQLIA) is performed by those persons who want to access the database and want to steal, change or delete the data which they do not have permission to access . In SQLIA adversary requests through a malicious query which shows some confidential data. In research, it is also proved that when a network and host-level entry point is highly secured, the public interface provided by an application is the one and only source of SQL injection attack. SQLIA can’t be applied without using space, single quotes or double dashes. So to prevent SQLIA, these options are taken in observation. Previous model used JDBC-LDAP library which did not support instances, alias and set operations (UNION and UNION ALL). If a query with injection is accepted by any database which is based on relational approach, then it will be accepted by all databases that are based on relational approach. This paper is focused on SQLIA and its techniques and encounters the shortcoming of previous models. This paper proposed a model which uses two databases one relational and other hierarchical to ensure about injection in a query, compare the results by applying tokenization technique on both databases. If the results are same, there is no injection, otherwise it is present. The proposed model uses a tokenization technique so; query containing Alias, Instances and Set operations can also be blocked at the entry point.