A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm

Oluwatobi Noah Akande,Oluwakemi Christiana Abikoye,Abdullahi Abubakar,Ahmed Haruna Dokoro,Aderonke Anthonia Kayode

doi:10.1186/s13635-020-00113-y

Abstract

Structured Query Language (SQL) injection and cross-site scripting remain a major threat to data-driven web applications. Instances where hackers obtain unrestricted access to back-end database of web applications so as to steal, edit, and destroy confidential data are increasing. Therefore, measures must be put in place to curtail the growing threats of SQL injection and XSS attacks. This study presents a technique for detecting and preventing these threats using Knuth-Morris-Pratt (KMP) string matching algorithm. The algorithm was used to match user’s input string with the stored pattern of the injection string in order to detect any malicious code. The implementation was carried out using PHP scripting language and Apache XAMPP Server. The security level of the technique was measured using different test cases of SQL injection, cross-site scripting (XSS), and encoded injection attacks. Results obtained revealed that the proposed technique was able to successfully detect and prevent the attacks, log the attack entry in the database, block the system using its mac address, and also generate a warning message. Therefore, the proposed technique proved to be more effective in detecting and preventing SQL injection and XSS attacks

Highlights

Internet is fast becoming a household technology with 4.39 billion users in January 2019 compared to 3.48 billion users in January 2018 [1]
Structured Query Language (SQL) injection is a serious threat for web application users
The database to be targeted was stored on mySQL database of size 4.998 MB

Summary

Introduction

Internet is fast becoming a household technology with 4.39 billion users in January 2019 compared to 3.48 billion users in January 2018 [1]. Users’ inputs via web applications are used to query back end databases so as to provide the needed information. This trend has opened up web Abikoye et al EURASIP Journal on Information Security (2020) 2020:14 vulnerabilities, insufficient logging, and monitoring. Among these forms of attacks, XSS and SQL injection have been identified as the most dangerous [5]. The WHERE clause in the SQL query SELE CT*FROM users WHERE password = 1234 could be manipulated when hackers supply inputs like ‘anything’ OR ‘1’ = ‘1’; #. SQL injection is a serious threat for web application users

Methods

Results

Conclusion