A Systematic Review and Taxonomy of SQL Injection Defense Techniques

This paper is focused on building a taxonomy of SQL injection defense techniques and classifying current methods according to that taxonomy. A systematic literature review (SLR) is conducted using the five major e-databases; IEEE, ACM, Engineering Village (Inspec/Compendex), ISI web of science and Scopus. 61 defense techniques were found and based on these techniques, a taxonomy of SQL injection defense techniques was built. The taxonomy consists of various dimensions which can be grouped under two higher order terms; detection method and evaluation criteria. The taxonomy provides a basis for comparison of different defense techniques. Organization(s) can use our taxonomy to choose suitable defenses depending on their available resources and environments. Moreover, this classification can lead towards a number of future research directions in the field of SQL injection prevention.

Anup Shakya has 10 years of professional experience as a programmer, most of it working with web application, e-commerce and web security issues at IT Company. He received his M.Sc. in Computer Science from Blekinge Institute of Technology, Sweden in 2011 and B.E. in Computer Engineering from Kathmandu Engineering College, Nepal in 2006.