Exploring Defense of SQL Injection Attack in Penetration Testing

Zhu, Alex; Yan, Wei

doi:10.4018/ijdcf.2017100106

Cited by 1 publication

(1 citation statement)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Frequently used queries can be saved in a stored procedure and can be recalled when requested. Since the location of stored procedure is within the database server, therefore the interaction between the program code and the table containing the data can be avoided [29]. This will improve the security of application program code because it can add another layer of abstraction before interacting with database [19].…”

Section: An Improved Stored Procedures Withmentioning

confidence: 99%

A Method to Prevent SQL Injection Attack using an Improved Parameterized Stored Procedure

Ahmad¹,

Karim²

2021

IJACSA

View full text Add to dashboard Cite

Structured Query Language (SQL) injection is one of the critical threats to database security. The effects of SQL injection attacks cause the data contained in the database to be at risk of being exploited by irresponsible parties, compromising data integrity, disrupting server operations and in return affecting the organization's image. Although SQL injection is an attack performed at the application level, SQL injection prevention requires security controls at all levels, namely application level, database level and network level. The absence of SQL injection prevention measures at the application level makes the database vulnerable to attack. Reviews indicate that the current approaches still not sufficient in addressing these three issues, which are i) improper use of dynamic SQL, ii) lack of input validation process and iii) inconsistent error handling. Currently, program and database code security is based solely on basic security measures that are focused at the network level such as network firewalls, database access control and web server request filtering. Unfortunately, these measures are still inadequate and not sufficient to safe guard the program code and databases from the attack. To overcome this shortcoming as addressed by these three issues, a new comprehensive method is proposed using an improved parameterized stored procedure to enhance database security. Experimental results prove that the proposed method is able to prevent SQL injection from occurring and able to shorten the processing time when compared with existing methods, hence able to improve database security.

show abstract

Section: An Improved Stored Procedures Withmentioning

confidence: 99%