© July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

Prevention of Data Leakage via SQL Injection

Shreya Chowdhury1, Miran Ahmad2, Aakansh Nandi3, Aadish Jain4, and Prof. Mohandas Pawar5
1,2,3,4
UG Student, MIT ADT University, Pune
5
Asst. Prof., MIT ADT University, Pune

Abstract - This project aims to prevent SQL injection encrypts and decrypts messages using the same key.
while performing a query. It does so by implementing a There are ten rounds of the 128-bit keys, twelve rounds
secure and online method to store and protect all the of the 192-bit keys and fourteen rounds of the 256-bit
sensitive data stored in the database. Another key
keys. A round consists of several operations: change
component of this system is encryption of card data. This
of one character, change of another, and
method is known as AES encryption. It works seamlessly
online and can be accessed from any location. This rearrangement of letters.
framework uses encryption techniques to prevent The AES was chosen because of its security and the
unauthorized access to the database. It also secures the fact that it is simple to implement. SQLi is also an
user data by storing it in a secure form. efficient way to attack databases. It will allow hackers
to add malicious code to existing SQL query without
Index Terms - AES, DES, SQL Injection, Database, the user knowing it. The data will be open to the
Decryption, Ciphertext. malicious hackers since any website or web
application that uses a SQL database can get attacked
I.INTRODUCTION by a SQL Injection vulnerability. Hackers may misuse
and exploit the confidential information stored on this
The goal of this project is to implement an encrypted device. Due to SQL injection vulnerability attacks,
website that enables users to shop for goods and such problems can still happen.
services online. This website will not store any
confidential information about the user. The project is The contribution of the paper is as follows;
designed to protect sensitive information and The purpose of this project is to provide a safe
transactions from being revealed. This method is used transaction for the users. Both the transaction and the
to secure electronic cash exchange transactions. The user data can be encrypted using the AES encryption
project aims to protect the privacy of electronic technique. This system encrypts the user’s log in
transactions. Its key component is the Advanced details to preserve privacy of the website’s clients. The
Encryption Standard (AES). device encrypts the transaction number and the bank's
Transactions with the use of encryption techniques PIN. It is less dangerous when getting hacked because
such as AES would be more secure and less prone to of the SQL Injection Prevention technologies used.
fraud. The Advanced Encryption Standard or AES is a
widely used encryption algorithm. It is a three-block II. LITERATURE SURVEY
cipher that can be used to secure data. The Advanced
Encryption Standard (AES) is a widely used To include an exhaustive examination of SQL
symmetric encryption algorithm. AES is a viral and injection, we studied papers from various journals,
widely used algorithm for encrypting confidential data conferences, and acquired data. The following is how
in software and hardware. AES is a family of three the various papers are organized:
block ciphers. AES-128 uses a 128-bit key length to They were the first to describe web application
encrypt the messages. Command Injection attacks in a methodical way. They
One hundred twenty-eight bits of information can be created and developed a suitable runtime filtering
encrypted, and 256 bits of information can be approach [1] using the concept of Command Injection
decrypted with 3 keys of 128, 192, and 256 bits. The Attack. It allows programs to protect themselves from
asymmetric key, also known as an asymmetric cipher, SQL injection attacks. Static analysis, dynamic

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 405

 © July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

analysis, and intelligent code re-engineering are key looked for efficient techniques to both detect and avert
components of the security testing process for attacks. This study looked at how SQLIAs could be
protecting existing properties [2]. integrated into an application and various approaches
A new method of detecting SQL injection sites. could be used to do so [11].
Runtime testing for potentially exploitable A review of how SQLIA injection works was
vulnerabilities are part of their strategy, as is later conducted. It can also alert us to any mishaps in which
application code review to ensure protection. By SQLi can be used. This study suggests a strategy for
altering the original SQL statement, the vulnerability preventing hacker attacks on the device. The hash
attack established its own targets [3]. They proposed a function technique is proposed in this paper, and it can
mechanism for ensuring that dynamic SQL queries are be used to mitigate SQL injection vulnerabilities [12].
accurate. For Java programmes, based on text analysis I proposed a method for preventing unwanted access
algorithms. Another technique, which has a low to the database authentication. The authentication
probability of false-positive predictions, has procedure in SQLIPA is based on passwords and hash
discovered problems in these applications [4]. values. On sample data from the user table, the
The first computer-aware fault-localization tool that SQLIPA was tested. The authentication technique
takes into consideration the interaction between an takes only 1.3 milliseconds [13].
application and its data. According to a review of In ASP.NET online applications, the SAFeLi
studies completed on three database applications, framework detects SQL injection vulnerabilities
present methods of locating are insufficient [5]. automatically. The algorithmic capabilities of the tool
They discussed numerous methods for detecting are its tools component. SAFELI creates an equation
vulnerabilities and combating SQL injection attacks based on strings that match a certain attacker pattern
[6]. The characteristics of SQL injection were [14] during symbolic execution. John Prescott, the
established, as well as the strategies for preventing it. Prime Minister of the United Kingdom, declared
It can be avoided by employing proper input validation Kashmir to be an integral part of India in 2006. They
and type-safe SQL parameters. By avoiding SQL are common incursions that are carried out on online
injections, a web app was constructed to keep SQL pages and applications. They are more difficult to
injection threats at bay [7]. comprehend than traditional SQL injection since they
The Insensitive Remote Code Execution attack are more subtle. The research investigates how
security approach was discovered, which protects detection and protection measures for these attacks
against all types of attacks by providing a unique were created [15].
execution environment for the running function. A unique method for identifying SQL injection attacks
Within this environment, the software's calling with omitted attributes[16]. This most recent
convention has no bearing. This is true for machine application is a piece of software that protects against
code as well as interpretive code [8]. Proposed a two- SQL injection attacks. The fundamental idea is to
stage approach: the first tokenizes the input query employ a randomised SQL language for a certain CGI
statement, and the second decodes the tokens to system to detect and abort requests that include
determine the expression [9]. malicious code. They could use a randomization
There are two parts to a hybrid technique: runtime strategy to run the same plan for each database back-
analysis and static analysis. To increase performance end. They should store the database in a form that
quality, the first step is to review the algorithm in real allows anyone from the outside to access it [17].
time. These findings should alert the developer of any They presented a paper regarding a survey they
potential flaws, and if any such errors exist, they must conducted on SQL Injection attacks. Different levels
be discovered and corrected. The software then does a of severity can be assigned to attacks. Detection and
static analysis, comparing new SQL queries to those preventive measures for SQL Injection are also
that have been scheduled and validated as safe [10]. covered in this book. In addition,it does a study of
Four different detecting approaches were examined. several database protection techniques[18]. SQLIAs
To evaluate the risks of SQLIAs, researchers must first were one of the most serious application security
characterise all of the distinct types of SQLIAs that vulnerabilities in 2017, according to a paper by Alwan,
have been detected thus far. The researchers next Z. S., and Younis, M. F., according to the business. A

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 406

 © July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

survey of SQL security issues is presented in this They offered many ways for network attack detection
work. The study discusses the history of SQL and prevention [29]. Different services are defined for
injections as well as detection strategies [19]. respective security approaches using third party
Instead of using the usual method, they advised using service [30].
the tokenization method to obtain tokens. Using This paper explains how MD5 and AES can be used to
forensics and security tools, either assault can be protect web-based applications from SQL injection
detected. This research was carried out using the Java attacks. SQL injection is a technique for gaining
programming language [20]. unauthorized access to a database. An attacker will
SQLi was defeated thanks to the introduction of a need the complete table name in order to get access to
crime-fighting tool. Positive and malicious traffic are a database. To counteract this attack, a solution based
frequently distinguished by web application policies. on double encryption is offered. In comparison to the
Early detection of such fraudulent actions will be old method, the algorithm adopted provides superior
required as part of the solution. In a complicated way, performance and security [31].
the methodology extracts a conservative model of all This paper focuses on employing five cryptographic
the inquiries that are anticipated to occur in the website methods (AES, Triple DES, RSA, Blowfish, and
from the source code. The system keeps track of what Twofish) to avoid SQL injection attacks. Finally, the
queries are made and how the models respond at study determines which cryptographic strategy is best
runtime. Queries that do not follow the flowchart for preventing SQLIA in online applications [32].
supplied are stopped and recorded [21]. To prevent SQL Injection attacks, this paper uses the
They devised a novel strategy to protect apps from 448-bit Blowfish coupled with additional security
SQLIAs. Using this method, new vulnerabilities were techniques to strengthen the existing model. To
discovered. The most important finding was that SQL encrypt and secure web data from SQL Injection
injections may be detected and prevented [22]. They attacks, we previously used RC4 and Normal
show that by fostering intelligent applications, an Blowfish, but now we employ the 448-bit Blowfish
intelligent system can help to prevent cyber-attacks Encryption approach, which has a lower execution
[23]. overhead [33].
SVMs were used to investigate both original and This paper proposed a protocol model for preventing
suspect queries. For classification, a dataset of various SQL Injection attack using AES (PSQLIAAES) [34].
sizes is used. Precision, detection time, training time,
TPR, TNR, FPR, FNR, and graphical details on our III. PROPOSED SYSTEM
system's performance are all displayed here. Our
method has the highest level of output accuracy, at The framework is made up of two main components:
96.5 percent [24]. A novel method for detecting SQL a website and a card database. The website will have
injection vulnerabilities in Android apps has been login procedures that need the user to enter his or her
developed. They maintain the app's code in a login information. After successfully creating an
subversive manner. The enlarged code looks like a account, a user can access their previous purchases and
Java programme and may be run with an SSH client. place new orders. The users' credit cards will be used
When performing static analysis, dummy classes are to pay for the things. To generate the cypher text, the
constructed automatically [25]. data is processed using the data encryption algorithm
For the identification of attacks, a novel SA-MVO (AES). After that, the cypher text is saved in the admin
technique based on deep learning was proposed [26]. database. SQL injection cannot be utilized to access or
For SQLi assaults, a novel technique has been exploit sensitive data in this scenario because of the
proposed that identifies and prevents these attacks encryption. The framework allows for further cyber-
[27]. A traditional booklet called "Pocket Certificates" security measures by helping to insulate databases
is presented in this paper. The ideal method is to from code injection. they are unavoidable.
employ a Triple Data Encryption Standard (AES) and In this system, when the user logs in to the website, the
Triple Data Encryption Standard (TDES) encryption log in data gets stored in the database in an encrypted
scheme (3DES). In terms of how security measures format. The secret key of the user is generated by
effect system performance, their use is debatable [28]. mixing the username and the password in a random

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 407

 © July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

order. The secret key and initial vector is generated ACKNOWLEDGMENT

separately. Since all the confidential data is encrypted
and stored in the database; even if the hacker gets First of all, we would like to thank our project guide
access to the database, they are not able to get access Prof. Mohandas V. Pawar for giving us the courage,
to the encrypted data. guidance and suggestions for doing this major project.
We also express our gratitude towards Dr. Rajneesh
Kaur Sachdeo, HOD CSE and Dr. Kishore Ravande,
Principal MITSOE sir for their support and guidance.
We are thankful to MIT School of Engineering-MIT
ADT University, Pune for providing all resources and
valuable information required about data mining
techniques for our project the process of analyzing and
Fig 1: Proposed System
doing research on the valuable inputs helped us to
explore knowledge, was a continuous source of
IV. RESULTS
inspiration and a unique experience.

REFERENCES

[1] Su, Z., & Wassermann, G. (2006). The essence of

command injection attacks in web applications.
Acm Sigplan Notices, 41(1), 372-382.
[2] Merlo, E., Letarte, D., & Antoniol, G. (2007,
March). Automated protection of php applications
against SQL-injection attacks. In 11th European
Conference on Software Maintenance and
Fig 2: Resultant Database Reengineering (CSMR'07) (pp. 191-202). IEEE.
After implementation of the AES encryption, the data [3] Wei, K., Muthuprasanna, M., & Kothari, S. (2006,
is encrypted and the data of the customers is safe. April). Preventing SQL injection attacks in stored
Databases are susceptible to unauthorized access procedures. In Australian Software Engineering
which can lead to tampering of data, integrity issues, Conference (ASWEC'06) (pp. 8-pp). IEEE.
modification and deletion of data etc. These types of [4] Gould, C., Su, Z., & Devanbu, P. (2004, May).
attacks can be prevented by using AES encryption, as Static checking of dynamically generated queries
is shown in this project. The data stored in the database in database applications. In Proceedings. 26th
in encrypted using secret key (as shown below). International Conference on Software
Engineering (pp. 645-654). IEEE.
V. CONCLUSION [5] Clark, S. R., Cobb, J., Kapfhammer, G. M., Jones,
J. A., & Harrold, M. J. (2011, November).
SQL injection is still a serious security concern for Localizing SQL faults in database applications. In
programmers. Encryption and decryption aid in the 2011 26th IEEE/ACM International Conference
protection of sensitive data. The encoding mode AES on Automated Software Engineering (ASE 2011)
is well-known, and it is supported by both hardware (pp. 213-222). IEEE.
and software, so far, there have been no realistic [6] Shar, L. K., & Tan, H. B. K. (2012). Defeating
cryptographic attacks on the AES attack. AES has also SQL injection. Computer, 46(3), 69-77.
offered a set of alternative keys that can be used to [7] Ma, L., Zhao, D., Gao, Y., & Zhao, C. (2019,
make improvements and to undertake exhaustive key September). Research on SQL Injection Attack
searches. Despite the fact that AES encryption is and Prevention Technology Based on Web. In
secure, it is simple to protect consumers from other 2019 International Conference on Computer
sorts of security attacks. A user can resolve the danger Network, Electronic and Automation (ICCNEA)
of data protection by following these measures. (pp. 176-179). IEEE.

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 408

 © July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

[8] Ping, C., Jinshuang, W., Lin, P., & Han, Y. (2016, [18] Kumar, P., & Pateriya, R. K. (2012, July). A
October). Research and implementation of SQL survey on SQL injection attacks, detection and
injection prevention method based on ISR. In prevention techniques. In 2012 Third
2016 2nd IEEE International Conference on International Conference on Computing,
Computer and Communications (ICCC) (pp. Communication and Networking Technologies
1153-1156). IEEE. (ICCCNT'12) (pp. 1-5). IEEE.
[9] Hlaing, Z. C. S. S., & Khaing, M. (2020, [19] Alwan, Z. S., & Younis, M. F. (2017). Detection
February). A detection and prevention technique and prevention of sql injection attack: A survey.
on sql injection attacks. In 2020 IEEE Conference International Journal of Computer Science and
on Computer Applications (ICCA) (pp. 1-6). Mobile Computing, 6(8), 5-17.
IEEE. [20] Ntagwabira, L., & Kang, S. L. (2010, July). Use
[10] Atoum, J. O., & Qaralleh, A. J. (2014). A hybrid of Query Tokenization to detect and prevent SQL
technique for SQL injection attacks detection and Injection Attacks. In 2010 3rd International
prevention. International Journal of Database Conference on Computer Science and
Management Systems, 6(1), 21. Information Technology (Vol. 2, pp. 438-440).
[11] Halfond, W. G., Viegas, J., & Orso, A. (2006, IEEE.
March). A classification of SQL-injection attacks [21] Halfond, W. G., & Orso, A. (2005, May).
and countermeasures. In Proceedings of the IEEE Combining static analysis and runtime monitoring
international symposium on secure software to counter SQL-injection attacks. In Proceedings
engineering (Vol. 1, pp. 13-15). IEEE. of the third international workshop on Dynamic
[12] Singh, S. P., Tripathi, U., & Mishra, M. (2014). analysis (pp. 1-7).
Detection and prevention of SQL injection attack [22] Jang, Y. S., & Choi, J. Y. (2014). Detecting SQL
using hashing technique. International Journal of injection attacks using query result size.
Modern Communication Technologies & Computers & Security, 44, 104-118.
Research, 2. [23] Batista, L. O., de Silva, G. A., Araújo, V. S.,
[13] Ali, S., Shahzad, S. K., & Javed, H. (2009). Araújo, V. J. S., Rezende, T. S., Guimarães, A. J.,
Sqlipa: An authentication mechanism against sql & Souza, P. V. D. C. (2019). Fuzzy neural
injection. European Journal of Scientific networks to create an expert system for detecting
Research, 38(4), 604-611. attacks by sql injection. arXiv preprint
[14] Fu, X., Lu, X., Peltsverger, B., Chen, S., Qian, K., arXiv:1901.02868.
& Tao, L. (2007, July). A static analysis [24] Rawat, R., & Shrivastav, S. K. (2012). SQL
framework for detecting SQL injection injection attack Detection using SVM.
vulnerabilities. In 31st Annual International International Journal of Computer Applications,
Computer Software and Applications Conference 42(13), 1-4.
(COMPSAC 2007) (Vol. 1, pp. 87-96). IEEE. [25] Edalat, E., Sadeghiyan, B., & Ghassemi, F.
[15] Singh, J. P. (2016). Analysis of SQL injection (2018). ConsiDroid: A concolic-based tool for
detection techniques. arXiv preprint detecting SQL injection vulnerability in android
arXiv:1605.02796. apps. arXiv preprint arXiv:1811.10448.
[16] Lee, I., Jeong, S., Yeo, S., & Moon, J. (2012). A [26] Mohandas V. Pawar, Dr. J. Anuradha, " Detection
novel method for SQL injection attack detection of Blackhole and Wormhole Attacks in WSN
based on removing SQL query attribute values. enabled by Optimal Feature Selection using
Mathematical and Computer Modelling, 55(1-2), Self-Adaptive Multi-Verse Optimizer with Deep
58-68. Learning”, International Journal of
[17] Boyd, S. W., & Keromytis, A. D. (2004, June). Communication Networks and Distributed
SQLrand: Preventing SQL injection attacks. In Systems- Inderscience(In Press).
International Conference on Applied [27] D. Patel, N. Dhamdhere, P. Choudhary and M.
Cryptography and Network Security (pp. 292- Pawar, "A System for Prevention of SQLi
302). Springer, Berlin, Heidelberg. Attacks," 2020 International Conference on Smart
Electronics and Communication (ICOSEC),

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 409

 © July 2021| IJIRT | Volume 8 Issue 2 | ISSN: 2349-6002

Trichy, India, 2020, pp. 750-753, doi:

10.1109/ICOSEC49089.2020.9215361.
[28] D. Agnihotri, S. Ahmed, D. Darekar, C. Gadkari,
S. Jaikar and M. Pawar, "A Secure Document
Archive Implemented using Multiple
Encryption," 2020 International Conference on
Smart Electronics and Communication
(ICOSEC), Trichy, India, 2020, pp. 765-770, doi:
10.1109/ICOSEC49089.2020.9215302.
[29] Intrusion Detection and Prevention in WSN and
MANET using Machine Learning
Techniques and Existing Challenges, Journal
International Journal of Advanced Science and
Technology, Volume-29, Issue-3, Pages-(306-
328), 2020.
[30] Mohandas Pawar Sujata Jadhav,Diksha
Bejgam,Shweta Nhawkar,Shital Sumbe, A Novel
Approach for Recommendation of Cloud Service
for Security using Trusted Third Party,
International Research Journal of Engineering
and Technology (IRJET), Volume-3, Issue-03,
Pages-(1794-1800), 2016.
[31] Sood, M., & Singh, S. (2017). SQL injection
prevention technique using encryption.
International Journal of Advanced Computational
Engineering and Networking, 5(7), 4-7.
[32] Karunanithi, J. S. (2018). SQL Injection
Prevention Technique Using Cryptography.
[33] Rajeswari, K., & Amsaveni, C. SQL Injection
Attack Prevention Using 448 Blowfish
Encryption Standard.
[34] Balasundaram, I., & Ramaraj, E. (2011). An
authentication mechanism to prevent SQL
injection attacks. International Journal of
Computer Applications, 19(1), 30-33.

IJIRT 152088 INTERNATIONAL JOURNAL OF INNOVATIVE RESEARCH IN TECHNOLOGY 410