Automatically Preparing Safe SQL Queries

We present the first sound program source transformation approach for automatically transforming the code of a legacy web application to employ PREPARE statements in place of unsafe SQL queries. Our approach therefore opens the way for eradicating the SQL injection threat vector from legacy web applications. Key words: Static program transformation, Security by construction, Symbolic evaluation, SQL injection

• Type: Conference
• Year: 2010
• Where: FC
• Authors: Prithvi Bisht, A. Prasad Sistla, V. N. Venkatakrishnan
• Keywords: Cryptology, FC 2010, Legacy Web Applications, SQL Injection, SQL Injection Threat