IBN AL- HAITHAM J. FOR PURE & APPL. SCI. VOL.24 (2) 2011 Proposed Methods To Prevent SQL Injection A. H. Mohmmed Department of Computer Science, College of Education, University of Al- Mustansiriyah Received in : 3, October , 2010 Accepted in : 8, February, 2011 Abstract In the last decade, the web has rapidly become an attractive platform, and an indispensable part of our lives. Unfortunately, as our dependency on the web increases so programmers focus more on functionality and appearance than security, has resulted in the interest of attackers in exploiting serious security problems that target web applications and web-based information systems e.g. through an SQL injection attack. SQL injection in simple terms, is the process of passing SQL code into interactive web applications that employ database services such applications accept user input such as form and then include this input in database requests, typically SQL statements in a way that was not intended or anticipated by the application developer that attempts to subvert the relationship between a webpage and its supporting database, in order to trick the database into executing malicious code due to the poor design of the application. The proposed system is based on protection website at run time, before inclusion of user input with database by validating, encoding, filtering the content, escaping single quotes, limiting the input character length, and filtering the exception messages. The proposed solution is effectiveness and scalability in addition it is easily adopted by application programmers. For empirical analysis, we provide a case study of our solution and implement in Html, PHP, MySql , Apache Server and Jmeter application. Key words:web site security , Data Base Server, SQL Injestion attack Introduction The Internet has brought about many changes in the way organizations and individuals conduct business, and it would be difficult to operate effectively without the added efficiency and communications brought about by the internet [1]. In the last few years, the popularity of web-based applications has grown tremendously. A number of factors have led an increasing number of organizations and individuals to rely on web-based applications to provide access to a variety of services. Today, web-based applications are routinely used in security critical environments, such as medical, financial, and military systems [2]. Because of the popularity of these types of applications many techniques to exploit their security vulnerabilities are potentially quite dangerous. One such technique is called SQL injection [3]. SQL Injection attack has been one of the major threats to the security of web applications and attackers can trick server into executing malicious SQL code which is [4]. occurs when user input is parsed as SQL tokens, thus changing the semantics of the underlying query [3]. SQL injection attacks have been used to extract customer and order information from e-commerce databases or bypass security mechanisms. The intuition behind such attacks is that predefined logical expressions within a predefined query can be altered simply by injecting operations that always result in true or false statements [5]. IBN AL- HAITHAM J. FOR PURE & APPL. SCI. VOL.24 (2) 2011 This paper, presents a runtime technique to prevent SQL injection observe that all SQL injections alter the structure of the query intended by the programmer and by capturing this structure at runtime, we can compare it to the parsed structure after inserting user-supplied input, and evaluate similarity . Evaluated the proposed system based on user input on a set of real-world applications without requiring a call to the database, thus lowering runtime costs and satisfy the following three criteria: 1. prevent the possibility of the attack 2. Minimize the effort required by the programmer 3. Minimize the runtime overhead. This paper is structured as follows: The next section reviews related work and section 3 describe web server technology and section 4 SQL injection working while section 5 describe proposed approach that characterizes the sanitization process by modeling the way in which an application processes input values and provides details about the implementation of system, section 6 presents the experimental results that show approach is feasible in practice, section 7 concludes the paper. -Web Server Technology Web based systems are a composition of infrastructure components, web servers , databases, and of application specific code, such as HTML-embedded scripts and server-side CGI programs[2]. Nowadays, lots of websites are interactive, dynamic and database-driven, which run various web applications in servers with data stored in back-end database. Web 2.0 technologies allow users to do more than just retrieve information. They can access and modify the content and distribute their information in websites such as social networking sites, wikis and blogs. In other words, they can control the database information via a web browser [6]. Web applications accept user input via forms in web pages. This input is posted to the server as name value pairs, both of which are strings. An alternate mechanism to pass information to the server is the query string. The query string is information appended to the end of the URL. On most web servers, a question mark separates the resource from the query string variables. Each name value pair in the query string is separated by an ampersand, and the user is free to edit this input as easily as form inputs. Because it is common for web servers can differentiate between variables passed in the query string and those posted in the form, then will consider both as user input [3].Web-based applications represent a serious security exposure. These applications are directly accessible through rewalls by design, in addition[7]. The infrastructure components are usually developed by experienced programmers with solid security skills, the application specific code is often developed under strict time constraints by programmers with little security training as a result vulnerable web- based applications are deployed and made available to the whole internet, creating easily exploitable entry points for the compromise of entire networks [2]. The Internet has brought about problems as the result of intruder attacks, both manual and automated, which can cost many organizations excessive amounts of money in damages and lost efficiency [1]. Web-based attacks aimed at either obtaining control of the host running the web server application (e.g., through a buffer overflow ) The first type of attack is caused by vulnerabilities in the web server software or in a server-side web-based application that allow one to compromise the security of the underlying host ,The second type of attack is [7] offer the vulnerabilities of unauthorized database control and malicious code injection which attackers can take advantage of attackers are trying to get valuable information held in database, this hack is a kind of application attack called SQL injection[6]. -SQL Injection Working It is very hard to understand the conceptual idea of SQL injection without partially understanding the code that runs in the background [8]. A database computer language designed for the retrieval and management of data in relational database management systems (RDBMS) [6]. IBN AL- HAITHAM J. FOR PURE & APPL. SCI. VOL.24 (2) 2011 Structured Query Language (SQL) is used for many database systems including Microsoft SQL Server, Oracle, MySQL and even Microsoft Access[8]. SQL injection is yet common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at site’s visitors, SQL injection is an attack on the site itself in particular its database [9]. In 2008, there was a significant increase in the number of websites affected by SQL injection attacks.This increase can be attributed in part to the development of automated tools that allowed attackers to test and compromise sites much faster than older manual methods.There are specific examples of SQL injection events that occurred in april 2008 attacks against microsoft internet information services (IIS) that affected more than half a million websites and in december 2008 microsoft internet explorer 7 (IE7) that was leveraged via SQL injection attacks [10]. SQL injection attacks are a prime example of malicious input that changes the behavior of a program by introduction of query structure into the input strings. An application that does not perform input validation (or employs error-prone validation) is vulnerable to SQL injection attacks. Although useful as a first layer of defense, input validation often is hard to get right, The absence of proper input validation has been cited as the number one cause of vulnerabilities in web applications [11]. A successful SQL injection exploit can read confidential data from the database ,modify database data (INSERT/UPDATE/DELETE), execute administration operations on the database such as shutdown of database management system (DBMS) , recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system, It may also lead to many potential attacks in other forms[6]. -Proposed System A web application is vulnerable to an SQL injection attack if an attacker is able to insert SQL statements into an existing SQL query of the application. This is usually achieved by injecting malicious input into user fields that are used to compose the query, login page prompts the user to enter her username and password into a form typ ically used for checking the user login credentials therefore, are prime targets for an attacker. In this example, if the login application does not perform correct input validation of the form fields, the attacker can inject strings into the query that alter its semantics. For example, consider an hacker entering “OR 1=1”-- one of sql injection string as in the tabel(1), the “--” command indicates a comment in Transact-SQL. Hence, everything after the first “--” is ignored by the SQL database engine with the help of the first quote in the input string, the user name string is closed, while the “OR 1=1” adds a clause to the query which evaluates to true for every row in the table. When executing this query, the database returns all user rows, which applications often interpret as a valid login. So in the proposed system all client-supplied data needs to be cleansed of any characters or strings that could possibly be used maliciously as shown in the figure(1). In this section list proposed methods can be applied to minimize the risk of a SQL injection attack . 1. Validation Input The first step in any form processing script should check the syntax of input for validity to verify that the input is a valid input in the language. The validation could be anything such as checking whether the entered value for “password" is a number, and is 16 or over, or making sure the username column has only valid characters such as A to Z, a to z and many classes of input have fixed languages such Email addresses, dates etc . 2. Encoding Input Sometimes input might contain some illegal characters, or it might not always be viable to validate all user input for example, in a search field the user could type anything that they are searching for, including script tags such as