SQL injection protection by variable normalization

• US 20060212438A1
• Filed: 03/16/2005
• Published: 09/21/2006
• Est. Priority Date: 03/16/2005
• Status: Abandoned Application

• Current Assignee: Ming Sum Sam Ng
• Original Assignee: Ming Sum Sam Ng
• Inventors: Ng, Ming Sum Sam
• Application Number:
  US11/081,298
• Publication Number:
  US 20060212438A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24534 Query rewriting; Transformation

Abstract

The invention provides a method for determining allowability of a structured query language (SQL) statement, the method comprising the steps of normalizing the SQL statement, and comparing the normalized SQL statement with a predetermined set of allowable statements.

Claims

1. A method for determining allowability of a structured query language (SQL) statement, the method comprising the steps of:

normalizing the SQL statement; and

comparing the normalized SQL statement with a predetermined set of allowable statements.

2. The method of claim 1, wherein the normalizing step includes the steps of:

converting each single-quoted string within the SQL statement to a single character;

converting all numbers within the SQL statement to a single numerical digit;

storing the converted SQL statement;

storing a position of each variable of the converted SQL statement;

storing a type of each variable of the converted SQL statement; and

storing a value of each variable of the converted SQL statement.

3. The method of claim 1, whereby the predetermined set of allowable statements includes a set of normalized SQL statements along with corresponding variable positions, variable types, and variable requirements, wherein

the set of allowable statements may be supplied manually or automatically;

and

the variable requirements include variable length, allowed characters, regular expression patterns, minimum values, and maximum values.

4. The method of claim 3, wherein

the automatically-supplied set of allowable statements includes stored normalized SQL statements and the variable positions and variable types corresponding to the stored normalized SQL statements;

and

the variable requirement is set to an expected value equal to an original value.

5. The method of claim 4, wherein

when a normalized SQL statement to be stored in the automatically-supplied set of allowable statements already exists, the normalized SQL statement to be stored and the existing normalized SQL statement are merged;

the normalized SQL statement to be stored and the existing normalized SQL statement are merged by checking each variable requirement stored in the allowable list;

the requirements are retained when the checking determines that they are the same; and

the variable is set to no requirements when the requirements are not the same.

6. The method of claim 3, whereby the comparing step comprises the step of searching for the SQL statement in the set of allowable statements, wherein

when the allowable list contains the SQL statement, verification of each variable value in the SQL statement is determined by checking it against the variable requirements located in the set of allowable statements;

and

the SQL statement is allowed when each variable value in the SQL statement is verified.