Design of an Automated SQL Injection Detection Tool for Web Applications

Abstract

World Wide Web (Web) applications have become an important interface for network services. However, the direct connection among user input, business logic, and database operations has also increased security risks. SQL injection vulnerabilities remain an important issue affecting Web application security. To address the low efficiency and repetitive nature of traditional manual detection, this paper designs an automated SQL injection vulnerability detection tool for Web applications. By analyzing the principles of SQL injection and common attack types, a detection process consisting of parameter extraction, payload construction, request transmission, response analysis, and vulnerability confirmation is established. The tool is tested in experimental environments involving MySQL, a Content Management System (CMS), and Damn Vulnerable Web Application (DVWA). Experimental results show that the tool can identify different types of SQL injection vulnerabilities based on characteristics such as page content, error messages, response length, and response time. It can improve vulnerability detection efficiency and the consistency of result interpretation, providing a useful reference for Web application security testing.