‘SQLBlock: SQL Injection Protection by Variable Normalization of SQL Statement’
We presented variable normalization for SQL statements, which can extract the basic structure of a SQL statement. If SQL injection happens, the structure of the SQL statement will be altered and hence normalized SQL statement will also be altered and we will be able to detect it. We use this method to implement SQLBlock, a database connectivity layer proxy driver that can block SQL injection attacks.
SQLBlock has very minimal overall performance impact. Theoretically, it works will all database servers without the need to change the client source code. Auto-learning the allowable list makes the system easy to deploy even for complex clients that will issue many different SQL commands. And since SQLBlock is a connectivity layer proxy, it works even for SSL web applications. We believe SQLBlock is an effective and practical solution to solve this class of attacks.’