A Classification of SQL Injection Attacks and Countermeasures

By William G. J. Halfond, J. Viegas, Alessandro Orso. International Symposium on Signals, Systems, and Electronics, 2006

800 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Prompt Injection attack against LLM-integrated Applications (2023, methodology): “This is inspired by traditional injection attacks such as SQL injection [10, 14, 25] and XSS attacks [23, 27, 63], where specially”
Fog computing security: a review of current applications and security solutions (2017, background): “This could result in the compromise of entire Fog system’s database or the forwarding of modified information to a central server [42].”
StruQ: Defending Against Prompt Injection with Structured Queries (2024, unknown): “SQL injection arises because the API to the database accepts a single string containing a SQL query, thereby mixing control (the type of SQL command to be performed, e.g., SELECT ) with data (e.g., a keyword to match on) [34, 35, 32].”
Edge Computing Security: State of the Art and Challenges (2019, background): “[110] also pointed out that most of the early defense mechanisms were not mature and that only two of them may have the potential to resolve practical SQL injection attacks.”
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment (2023, background): “The goal of an SQL injection attack is to gain unauthorized access to a database, steal sensitive information, or execute arbitrary commands on the database server [79]; • Command Injection: an attack that targets web applications by injecting malicious commands into an input field with the ultimate”