A Survey of SQL Injection Defense Mechanisms
Kasra Amirtahmasebi, Seyed Reza Jalalinia and Saghar Khadem Chalmers University of Technology, Sweden akasra, seyedj, saghar{@student.chalmers.se}

Abstract
SQL Injection Attack (SQLIA) is a prevalent method which makes it possible for the attackers to gain direct access to the database and culminates in extracting sensitive information from the firm’s database. In this survey, we have presented and analyzed six different SQL Injection prevention techniques which can be used for securing the data storage over the Internet. The survey starts by presenting Variable Normalization and will continue with AMNESIA, Prepared statements, SQL DOM, SQLrand and SQLIA prevention in stored procedures respectively.

that determining whether a SQL statement is allowable or not is done by checking the existence of normalized statement in the ready-sorted allowable list.

2.1. Background
Many web pages ask users to input some data and make a SQL queries to the database based on the information received from the user i.e. username and passwords. By sending crafted input a malicious user can change the SQL statement structure and execute arbitrary SQL commands on the vulnerable system. Consider the following username and password example, in order to login to the web site, the user inputs his username and password, by clicking on the submit button the following SQL query is generated: SELECT * FROM user_table WHERE user_id = ‘john’ and password = ‘1234’ Now consider what will happen if the user input the following password: ‘ or 1=1 – The SQL query will become: SELECT * FROM user_table WHERE user_id = ‘john’ and password = ‘’ or 1=1 --' The “or 1=1” will result in returning all the records in the “user_table” and the “--“ comments out the last ‘ appended by the system. Therefore, the query will return a non-empty result set without