SDriver: Location-specific signatures prevent SQL injection attacks

sql injection attacks involve the construction of application input data that will result in the execution of malicious sql statements. Many web applications are prone to sql injection attacks. This paper proposes a novel method for preventing this kind of attacks by placing a database driver proxy between the application and its underlying relational database management system. To detect an attack, the driver uses stripped-down sql queries and stack traces to create sql statement signatures that are then used to distinguish between injected and legitimate queries. The driver depends neither on the application nor on the rdbms and can be easily retrofitted to any system. We have developed a tool, sdriver, that implements our technique and tested it successfully on several web applications.