Preventing SQL Code Injection by Combining Static and Runtime Analysis

Many software systems have evolved to include a Web-based component that makes them available to the public via the Internet and can expose them to a variety of Web-based attacks. One of these attacks is SQL injection, which can give attackers unrestricted access to the databases underlying Web applications and has become increasingly frequent and serious. In this project, we developed techniques and tools to detect, prevent, and report SQL injection attacks. Our techniques leverage static and dynamic analysis, are effective and efficient, and have minimal deployment requirements. Given a previously developed Web application, our tools automatically transform the application into an equivalent application that is protected from SQL injection attacks. In the project, we also developed a testbed that can be used to evaluate SQL injection detection and prevention tools. Our testbed has been used extensively both by us and by other organizations. The tools and techniques developed within the project are being disseminated through different channels and are currently being commercialized by our industrial partner.