A Method to Prevent SQL Injection Attack using an Improved Parameterized Stored Procedure

Structured Query Language (SQL) injection is one of the critical threats to database security. The effects of SQL injection attacks cause the data contained in the database to be at risk of being exploited by irresponsible parties, compromising data integrity, disrupting server operations and in return affecting the organization's image. Although SQL injection is an attack performed at the application level, SQL injection prevention requires security controls at all levels, namely application level, database level and network level. The absence of SQL injection prevention measures at the application level makes the database vulnerable to attack. Reviews indicate that the current approaches still not sufficient in addressing these three issues, which are i) improper use of dynamic SQL, ii) lack of input validation process and iii) inconsistent error handling. Currently, program and database code security is based solely on basic security measures that are focused at the network level such as network firewalls, database access control and web server request filtering. Unfortunately, these measures are still inadequate and not sufficient to safe guard the program code and databases from the attack. To overcome this shortcoming as addressed by these three issues, a new comprehensive method is proposed using an improved parameterized stored procedure to enhance database security. Experimental results prove that the proposed method is able to prevent SQL injection from occurring and able to shorten the processing time when compared with existing methods, hence able to improve database security.

@article{Ahmad2021,
  title     = {A Method to Prevent SQL Injection Attack using an Improved Parameterized Stored Procedure},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {12},
  number    = {6},
  year      = {2021},
  publisher = {The Science and Information Organization},
  author    = {Kamsuriah Ahmad and Mayshara Karim},
  doi       = {10.14569/IJACSA.2021.0120636},
  url       = {https://doi.org/10.14569/IJACSA.2021.0120636}
}