Building Next-Generation Converged Networks

A Walk through SQL Injection  ◾  191

a small number of false negatives. e only disadvantage of this approach is that it involves a num-

ber of steps using different tools.

6.8.2 SQLrand Scheme

In [33], the SQLrand approach (approach using randomized SQL query language, targeting a

particular Common Gateway Interface application) was proposed by Boyd and Keromytis. For the

implementation, they used a proof-of-concept proxy server in between the web server (client) and

the SQL server; they derandomized queries received from the client and sent the request to the

server. is derandomization framework has two main advantages, that is, portability (applied

with wide range of DBMS) and security (database content highly protected). e proposed scheme ...