SQL injection protection through well typing and type checking.

摘要

In client/server software systems clients often interface with database servers by dynamically generating strings which are to be interpreted as an SQL query. The practice of passing raw string data that may or may not be syntactically correct or well-typed admits the possibility of run-time errors and compromises the security of the database by opening them to injection attacks. In this paper we present a static type system for a core subset of SQL. Roughly, a dynamically generated SQL query is well-typed with respect to a database instance if it only refers to table names and field names that exist in the target database, are in scope in the body of the query, and if the uses of those references are all well-typed. We present a formal semantics for our subset and present theorems stating the soundness of the type system. We also describe the implementation of a type checker based on the type system presented here. The checker is implemented in F