| Web applications take parameters from users and make SQL queries to the database. With SQL injection, it is possible for malicious application users to send inputs that contain malicious statements that will change the SQL statement structure and thus allowing the attacker to execute arbitrary SQL commands on the vulnerable system. There are only two types of variables in a SQL statement, strings and numbers. As specified by SQL standards, strings variables are single quoted, whereas numbers are not. According to the structure of SQL Injection attacks, an attacker cannot succeed without sending inputs that contains at least one single quote or double dashes in a string input field. It is also impossible for an attacker to send input that contains attacks statements in a numeric input field once the numeric input field is validated to accept numbers only. As every input field in the query is delimited by two single quotes, the number of single quotes corresponds to the double of string input fields. This is the foundation of our approach because it is based on tokenizing a query by following the rule of getting the number of tokens which is equal to the number of string user input fields that exist in a query. The number of tokens is obtained by dividing the query's number of single quotes by two. When the number of single quotes is not divisible by two, the query contains a syntax error, and thus it cannot be executed. With our approach of query tokenization to the detection of SQL Injection Attacks, an application programmer must keep the number of tokens of every query that he constructs in a folder that we called HashMapTable. When a user sends information request through an application the query must be tokenized again to see if the submitted user inputs do not contains SQL Injection Attacks. If a user has made SQL Injection Attacks, it means he/she has included extra single quotes or double dashes in his inputs and consequently the number of tokens has increased. To implement query tokenization approach, we developed and implemented using java two algorithms, one for query tokenization and another for injection detection. The developed java classes have been integrated in Students Records System which we designed for our approach test purposes. We tested the efficiency of our approach and results shows that by using query tokenization Students Records System degree of vulnerability is at only 5.54%and this vulnerability can also be cured by implementing other security means like user inputs validation. |
