privileges. The SQL code to authorize an should be rejected. In fact, they can ‘ action to a role category is: modify the database structure. Moreover, acceptable answers should be white-listed, GRANT action_name instead of using black listing to filter ON object_name unwanted answer. Eventually, SQL DoM TO role_name; (Domain Object model) provides a safe In addition to this access control, access access to databases via encapsulation rights that vary from one person to another. technique. Instead of using string In fact, access right may concern the entire concatenation, the query-building process database, individual tables or selected rows will use a type-checked API. Input filtering and columns. It may also be determined on and type checking of input will be applied the content, i.e. information upon a certain within the API. value is not available. During the database Detection: In case of an attack, it is development stage, a low-privilege account important to be able to detect it. The should be created first and then, if signature based technique attempts to necessary, some permission could be added. match specific attack patterns. In fact, a SQLi countermeasures database of attack input string (signature) is created. Then the input is compared with Many approaches to fix SQLi attacks issue the different signatures at runtime. have been proposed. They can be divided Detection can also apply on abnormal into three categories: Defensive coding, behavior. This technique has to be preceded Detection and Run-time prevention12. by a training phase to allow the system to define normal behavior. Therefore, a test Defensive coding: Insecure coding practices suite generates a high range of SQLi attacks SQLi attacks success. Insufficient input in order to detect vulnerabilities. Finally, validation is a common vulnerability, database auditing can investigate suspicious checking its type, size or content and activities by monitoring and gathering performing pattern matching to distinguish information on database users’ activities. normal from abnormal input can reduce the number of forcing errors attacks in the Runtime prevention techniques examine DBMS. Using prepared statement to pass queries structure before and user input. the input value parameter separately will It accepts only legal queries stored in a prevent attackers from modifying query master file. This file needs to be structure. Special characters as -- ; */ /* xp_
privileges. The SQL code to authorize an action to a role category is: GRANT action_name ON object_name TO role_name; In addition to this access control, access rights that vary from one person to another. In fact, access right may concern the entire database, individual tables or selected rows and columns. It may also be determined on the content, i.e. information upon a certain value is not available. During the database development stage, a low-privilege account should be created first and then, if necessary, some permission could be added. SQLi countermeasures Many approaches to fix SQLi attacks issue have been proposed. They can be divided into three categories: Defensive coding, Detection and Run-time prevention12. Defensive coding: Insecure coding practices SQLi attacks success. Insufficient input validation is a common vulnerability, checking its type, size or content and performing pattern matching to distinguish normal from abnormal input can reduce the number of forcing errors attacks in the DBMS. Using prepared statement to pass the input value parameter separately will prevent attackers from modifying query structure. Special characters as -- ; */ /* xp_ ‘ should be rejected. In fact, they can modify the database structure. Moreover, acceptable answers should be white-listed, instead of using black listing to filter unwanted answer. Eventually, SQL DoM (Domain Object model) provides a safe access to databases via encapsulation technique. Instead of using string concatenation, the query-building process will use a type-checked API. Input filtering and type checking of input will be applied within the API. Detection: In case of an attack, it is important to be able to detect it. The signature based technique attempts to match specific attack patterns. In fact, a database of attack input string (signature) is created. Then the input is compared with the different signatures at runtime. Detection can also apply on abnormal behavior. This technique has to be preceded by a training phase to allow the system to define normal behavior. Therefore, a test suite generates a high range of SQLi attacks in order to detect vulnerabilities. Finally, database auditing can investigate suspicious activities by monitoring and gathering information on database users’ activities. Runtime prevention techniques examine queries structure before and user input. It accepts only legal queries stored in a master file. This file needs to be