一种防SQL注入的静态分析方法

提出了一种基于静态分析的SQL注入攻击的检测方法。静态分析Web应用程序的源文件,提取污染源到执行参数的构造路径,形成检测规则。动态执行时替换规则中的输入参数为用户输入值,比较得到的SQL语句和原SQL语句在语义和结构上的异同,判断是否存在SQL注入攻击。实验结果表明,该方法有效可行,增加了过滤模块后对系统的性能影响不大。

A static analysis method of anti-SQL injection attack

This paper proposes a detection method of SQL injection attack based on static analysis. It statically analyzes the source pages of Web application, extracts taint to execution parameters’ constructed path and forms detection rules. The input parameters in rules are replaced by user input values during dynamic enforcement. By comparing the resulting SQL statements with the original SQL statements in the semantic and structural similarities and discrepancies, the method will determine whether SQL injection attack exists in the Web application. Experiments results show its effectiveness and feasibility since it has little effect on system performance after increasing the filtering module.