Measuring the effectiveness of output filtering against SQL injection attacks

Abstract

SQL injection (SQLi) attacks present severe risks to applications; they may result in the unintended exposure, modification, corruption, or deletion of information. An error in a single line of code can introduce a vulnerability to an application, compounding the risk. There are a variety of strategies for detecting and mitigating SQLi, including but not limited to output filtering. Output filtering protects a system and its information by validating the records that are returned from the database management system. In this paper, we evaluate the effectiveness of output filtering, which has not yet been examined in the literature. We employ output filtering to protect custom Web application known to be vulnerable to SQLi attack. An experiment was performed to determine if output filtering was able to defend an application against SQLi attacks, as well as measure the potential performance impact. Results demonstrate that output filtering has the potential to defend against SQLi attacks and has a limited impact on an application's response time.