Using parse tree validation to prevent SQL injection attacks

By Gregory Buehrer, Bruce W. Weide, Paolo A. G. Sivilotti. Joint Conference on Lexical and Computational Semantics, 2005

461 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

View Paper: https://www.semanticscholar.org/paper/31e08df2e3d603c6ad60f75bcb893803ab73ca98

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Gary Wassermann
2. Zhendong Su
3. Ian Goldberg
4. Femi G. Olumofin
5. William G. J. Halfond
6. J. Viegas
7. Alessandro Orso
8. Adam Kiezun

In Information Systems

1. Zhendong Su
2. Gary Wassermann
3. William G. J. Halfond
4. J. Viegas
5. Ian Goldberg
6. Alessandro Orso
7. Adam Kiezun
8. Premkumar T. Devanbu

Citations in the corpus

• Privacy-Preserving Queries over Relational Databases (2010, background): “Of note is the related observation made between parameterized SQL queries and parse tree validation [9], [23].”
• A Classification of SQL Injection Attacks and Countermeasures (2006, methodology): “SQLGuard [6] • • • • × • •”
• The essence of command injection attacks in web applications (2006, unknown): “[6].”
• Sound and precise analysis of web applications for injection vulnerabilities (2007, methodology): “Buehrer et al. also enforce a policy that user input must be a single token in the query, but they do not rely on a static analysis [ 2 ].”