Random Articles
Reseach Article
A Survey on Authentication Mechanism against SQL Injection in XML
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 78 - Number 7 |
| Year of Publication: 2013 |
| Authors: Preshika Tiwari, Ashish Kumar Srivastava |
10.5120/13501-1249
|
Preshika Tiwari, Ashish Kumar Srivastava . A Survey on Authentication Mechanism against SQL Injection in XML. International Journal of Computer Applications. 78, 7 ( September 2013), 22-25. DOI=10.5120/13501-1249
Abstract
SQL Injection Attacks (SQLIAs) are very serious intrusion attacks on database driven web application because such attacks can lacks the confidentiality and integrity (security) of data (information) in databases. In reality, unauthorized person intrudes to the web database and then after accordingly, enter in the data. To prevent this type of attack various approaches are proposed by analysts but they are not sufficient because most of implementing techniques will not stop all types of attacks. This paper presents the different kinds of SQL Injection attacks on the web based XML data and on the various present SQLIAs prevention techniques . This paper shows the existing SQLIAs prevention techniques which will demand the client side data, one by one and then validate Which will make typical the developer's job to write various different validation codes for each data page which is receiving in the server side. This paper reviewed the various security threats and XML database and analyze the available security mechanism to protect against the above attacks. This paper also presents the various research scopes in XML SQLIAs.
References
- Rafael Bosse brinhhosa, Carla Merkle Westphall and Carlos Becker Westphall,"Proposal and development of the web services input validation model" 978-1-4673-0269-2/12/$31. 00@2012 IEEE.
- Atefeh Tajpour, Maslin Massrum and Mohammad zaman Heydari. "Comparison of SQL Injection detection and prevention techniques," in proceeding of 2nd international conference on education technology and computer(ICETC)
- Christian mainka,juraj somorovsky and jorg schwenk,"Penetrating testing tool for web services security,"2012 IEEE eighth world conference on services
- P. Bisht, P. Madhusudan, and V. N. Venkratakrishnan, "CANDID: dy- namic candidate evaluations for automatic prevention of SQL injection attacks," ACM Trans. Inf. Syst. Secure. , vol. 13, no. 2, pp. 1–39, 2010.
- K. Kemalis and T. Tzouramanis, "SQL-ids: a speci?cation-based approach for SQL-injection detection," in Proceedings of the 2008 ACM symposium on Applied computing, sir. SAC '08. ACM, 2008, pp. 2153–2158.
- S. Bandhakavi, P. Bisht, P. Madhusudan, and V. N. Venkatakrishnan, "Candid: preventing SQL injection attacks using dynamic candidate valuations," in Proceedings of the 14th ACM Conference on Compute and communications security, sir. CCS '07, 2007, pp. 12–24.
- X. Jin and S. L. Osborn, "Architecture for data collection in database intrusion detection systems," in Proceedings of the 4th VLDB conference on Secure data management, sir. SDM'07, 2007, pp. 96–107.
- Y. -W. Huang, S. -K. Huang, T. -P. Lin, and C. -H. Tsai, "Web application security assessment by fault injection and behavior monitoring," in Proceedings of the 12th international conference on World Wide Web,ser. WWW '03, 2003, pp. 148–159.
- G. Wassermann, C. Gould, Z. Su, and P. Devanbu, "Static checking of dynamically generated queries in database applications," ACM Trans. Softw. Eng. Methodol. , vol. 16, no. 4, Sep. 2007.
- G. Wassermann and Z. Su, "An analysis framework for security in web applications," in In Proceedings of the FSE Workshop on Speci?cation and Veri?cation of Component-Based Systems (SAVCBS 2004, 2004, pp. 70–78).
- X. Fu and K. Qian, "Safeli: Sql injection scanner using symbolic execution," in Proceedings of the 2008 workshop on Testing, analysis, and veri?cation of web services and applications, ser. TAV-WEB '08, 2008, pp. 34–39.
- G. Buehrer, B. W. Weide, and P. A. G. Sivilotti, "Using parse tree validation to prevent sql injection attacks," in Proceedings of the 5th international workshop on Software engineering and middleware, ser. SEM '05, 2005, pp. 106–113.
- Z. Su and G. Wassermann, "The essence of command injection attacks in web applications," SIGPLAN Not. , vol. 41, no. 1, pp. 372–382, Jan. 2006.
- W. G. J. Halfond and A. Orso, "Amnesia: analysis and monitoring for neutralizing sql-injection attacks," in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, ser. ASE '05, 2005, pp. 174–183.
- Diallo Abdoulaye Kindy and Al-Sakib Khan Pathan,"A survey on SQL injection:vulnerabilities,attacks and prevention techniques," in 2011 IEEE 15th international symposium on consumer electronics.
Index Terms
Keywords