Effectiveness of structured query language injection attacks detection mechanisms

• Main Author: Mohamad, Nurul Zawiyah
• Format: Thesis
• Language: English
• Published: 2008
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://eprints.utm.my/id/eprint/9510/1/NurulZawiyahMohamadMFSKSM2008.pdf; http://eprints.utm.my/id/eprint/9510/; http://dms.library.utm.my:8080/vital/access/manager/Repository/vital:856?site_name=Restricted Repository
• Institution: Universiti Teknologi Malaysia

Database security is one of the most essential factors in keeping stored information safe. These days, web applications are used widely as a meddler between computer users. Web applications are also used mostly by e-commerce companies, and these types of applications need a secured database in order to keep sensitive and confidential information. Since SQL injection attacks occurred as a new way of accessing database through the application rather than directly through the database itself, they have become popular among hackers and malicious users. Many prevention and detection mechanisms are developed to handle this problem but these mechanisms have their limitations. In this study, two mechanisms, AMNESIA and SQL Guard are adopted for a practical evaluation to search for the better technique in detecting SQL injection attacks. These techniques will be called Technique A and Technique B respectively and will be evaluated on their effectiveness and efficiency using precision and recall measure against two web applications, Mekar and myMarket. The study will show that Technique B is a better approach on detecting SQL injection attacks.