# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
Second, the eight applications are all commercial ones, freely available from source code websites and widely used. Third, many of the vulnerabilities in these applications have already been submitted to CVEs, and these known vulnerabilities allow us to manually verify their exploitability, which facilitates our analysis of false positives and false negatives. The eight web applications contain a total of 50 known vulnerabilities. We try to select the most recent and latest versions of the application for evaluation so that the evaluation results are more realistic. Since newer applications are more likely to be downloaded and used by users, the value of detecting a 0-day vulnerability is higher. However, unfortunately, no 0-day vulnerabilities were found in our experiments. Eight web applications of this evaluation are summarized in Table 1 using the detailed information. This includes size, version, release date, number of lines of code, number of files included, number of known vulnerabilities, and a specific CVE number. We compared OODBE-SCAN with the latest open-source versions of RIPS and Seay, both static analysis tools for detecting vulnerabilities in web applications. Among them, we selected the open-source version of the latest version of RIPS 0.55, and there is also a commercial version of RIPS 2.9.0, but we cannot apply the commercial version of RIPS because it is not open source. Seay currently has only one version and is open source. RIPS and OODBE-SCAN are websites, and when we set them up, we selected Apache2.4 for the server, PHP7.3 for the language, and MySQL5.7 for the database. Seay can be used directly after being installed locally. We cannot compare with other static analysis tools because they are not open source [27] or the code is incomplete [6]. All the experiments were done on a machine with Intel Core i7-9700k 3.6 Ghz, 16 GB RAM, and 64-bit Windows 10. For a fair comparison, we applied the same source point, sink point, and sanitization rule definitions for OODBE-SCAN, RIPS, and Seay. In our evaluation, we will use precision (\(P\)) and R as our evaluation criteria, where \(P\) refers to the ratio of detected true positives (\(TP\)) to all vulnerabilities detected by the tool (including \(TP\) and false positives (\(FP\))):

\[P=\frac{TP}{TP+FP} \tag{1}\]

\(R\) is the ratio of the number of \(TP\) detected to the actual number of vulnerabilities (which is the sum of \(TP\) and false negatives (\(FN\)) that were not detected):

\[R=\frac{TP}{TP+FN} \tag{2}\]

### Comparison with RIPS

To validate RQ1, we choose to compare OODBE-SCAN with RIPS. There are two main reasons for this choice: firstly, RIPS is an open-source static analysis tool commonly used as a benchmark in related research papers; Second, RIPS does not accurately model object-oriented properties, and our tool is an improvement over RIPS by incorporating program transformation components. Therefore, we conducted a comparison experiment between OODBE-SCAN and RIPS in order to objectively evaluate the results and provide meaningful references. These evaluations aim to determine if our technique can detect more SQL injection vulnerabilities in specific environments compared to traditional static analysis methods. To ensure a fair comparison, we made modifications to the source code of RIPS by adding the method name \"query\" to its sink list before conducting the comparative experiments. The experimental results show that OODBE-SCAN detected 41 true vulnerabilities and 52 false positives, with a P of 0.44 and an R of 0.82. On the other hand, RIPS generates a large number of false positives during detection. It found a total of 237 vulnerabilities, out of which only 8 were true vulnerabilities, resulting in 217 false positives. The P was only 0.04, and the R was merely 0.16. The experimental results indicate that, compared to traditional static analysis techniques, OODBE-SCAN not only detects more SQL injection vulnerabilities in web applications with OODBE but also leads to fewer false positives.