SQLi and XSS Attack Introduction and Prevention Technique

Abstract

Nowadays, web applications are common around the world. every major company/organization have a web application presence. Max of these organizations use web applications to provide various services to clients. Some of these web applications employ database driven content. The back-end database often contains confidential and sensitive information such Password, credit card number, financial data, medical data, email details. Typically the web user/client supplies information, such as a username and password and web server receive user request and interact with the back-end database and returned relevant data to the Front-end.Web Applications penetration testing and security has become progressively most important these days. A lot numbers of malicious attacks are being deployed on the web application. Due to dramatic increase in Web applications usage, Web application get vulnerable to variety of threats. Most of these malicious attacks are targeted towards the web application layer and waf firewall alone cannot prevent these kinds of attacks. The reason behind success of these attacks is the ignorance of application developers while coding the web applications and the predefined vulnerabilities in the existing technologies. Web application attacks are the latest trend and hackers are trying to hack/exploit the web application using different techniques. Various types of solutions are available as open source and in market. But the selection of suitable solution for the security of the organizational systems is a major issue. Some Attack Prevention Technique protect web applications from attacks they sit in front of web applications monitors activity, and block malicious traffic.

A Method to Prevent SQL Injection Attack using an Improved Parameterized Stored Procedure

“…Although, these language are beneficial and userfriendly; but at the same time they expose the web applications to SQL injection. Often web applications are vulnerable to the attacks when dynamic SQL statements are being used [7]. Because, this language is dynamic in nature, therefore, an unauthorized user can modify the original query by injecting a malicious code to the query at run-time [24].…”

“…There are a number of threats to database security: among them are i) excessive privilege which refers to users who are given permission to access or carry out various transactions in the database but abuse the permission instead, and ii) SQL injection which is the entry of unauthorized input into the database to carry out any instructions that are not valid [6]. In addition, weak audit trails or automatic recording of database transactions that are not performed properly and media used as storage for backups such as hard disks and tapes are also prone to theft [7]. Therefore to improve database security, this paper aims to propose a new method in preventing SQL injection.…”