Abstract:<p>Structure Query Language Injection Attack is among the top 10‐security threats that can be used on the web application to cause severe damage or gain unauthorized data access to the application server. Many reports have indicated an average of 64% of global websites are at risk of being attack by SQL injection, and many of the top companies have experienced thousands of attacks attempts through SQL injection. The current trend shows the increasing number of attacks factor as a result of the daily deployment of these applications without security detection and prevention mechanism is placed. To overcome this challenge, researches in academia and industry presented a proposal that automates SQL injection vulnerabilities assessment on the tested application. Current studies show the need to enhance techniques of these proposals to reduce the false alarms. In this study, we propose a component‐based technique to minimize the incidence of inaccurate results, as well as enable the ease of improving the proposed solution. The study uses three costumed applications as tested to evaluate the accuracy of the proposed solution. Each of these testbed consists of several vulnerabilities where the experimental evaluation performs to test the proposed tool. An empirical evaluation is carried out on three vulnerable custom websites to evaluate the effectiveness of the proposed study. The experiment results indicated significant results in terms of high accuracy. On the other hand, the proposed solution also has better capabilities to analyze page response based on four different techniques. Moreover, the proposed solution is the only solution that performs stored procedure attacks SQL and bypass login authentication even if the returned records are limited restriction is applied.</p>

Research on the Technology of Detecting SQL Injection Vulnerabilities Based on Data Flow Analysis

Exploring injection prevention technologies for security-aware distributed collaborative manufacturing on the Semantic Web

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Test Method on Code Injection Vulnerabilities of Web Application

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system

Exploring Defense of SQL Injection Attack in Penetration Testing

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

The Detection and Defense Mechanism for SQL Injection Attack Based on Web Application

Research on SQL Injection Attack and Defense Technology of Power Dispatching Data Network: Based on Data Mining

Detection of structure query language injection vulnerability in web driven database application

An algorithm for detecting SQL injection vulnerability using black-box testing

Detection of SQL Injection Vulnerability in Embedded SQL

Framework of SQL Injection Attack

SQL Injection Vulnerability Detection Based on Webpage DOM Tree Comparison

Method of Preventing SQL Injection Attack Using PHP

A Detective Tool Against Sql Injection Attacks Based on Static Analysis and Dynamic Monitor

Design and Implementation of SQL Injection Vulnerability Scanning Tool

SQL Injection Attack Detection and Prevention Techniques Using Deep Learning

Detection and Prevention of SQL Injection Attacks Using Semantic Equivalence

SQL Injection Prevention Based on Sensitive Characters