Anti SQL Injection with Statements Sequence Digest

SQL Injection (SQLI) is an attack method that is easy to achieve but often leads data leak and malicious control of the system, so anti SQLI is very important for applications using database. This paper proposes an algorithm for detecting SQLI based on statements sequence digest (SSD). Abstract SQL statement, SSD and its calculating method are defined; algorithms for building SSD and detection SQLI in application are given. For SSD is calculated from the SQL statements sequence context, the proposed algorithm is not only more reliable than filtering special characters and words, but also more exact than checking single SQL statement. Experiments show that the proposed algorithm is implementation feasible and performance efficient.