# TPSQLi: Test Prioritization for SQL Injection Vulnerability Detection in Web Applications
## 3 Related Work  
SQL injection (SQLi) remains a significant threat to the security of web applications, prompting the development of various detection and testing methodologies [21]. In 2019, [PERSON] et al. proposed ART4 SQLi, an adaptive random testing method based on SQLMAP that prioritizes test cases to efficiently identify SQLi vulnerabilities, reducing the number of attempts needed by over 26% [9]. Unlike static order test prioritization, which calculates the distance between payloads, our tool employs a dynamic adjustment mechanism, enhancing detection efficiency.  
Furthermore, most research needs to address the test prioritization of SQL injection. [PERSON] et al. introduced SQIRL in 2023, which utilizes deep reinforcement learning with grey-box feedback to intelligently fuzz input fields, generating diverse payloads, discovering more vulnerabilities with fewer attempts, and achieving zero false positives [22]. However, this method does not include test prioritization. Similarly, [PERSON] et al. (2021) simulated SQLi attacks using Q-learning agents within a reinforcement learning framework, modeling SQLi as a security capture-the-flag challenge, enabling agents to learn generalizable attack strategies [25]. In the same year, [PERSON] developed an ensemble classification-based method that detects and classifies SQLi attacks as simple, unified, or lateral, utilizing features from the OWASP dataset to achieve high detection and classification accuracy [26]. Additionally, in 2023, [PERSON] et al. created a Chrome extension to detect and prevent SQLi and XSS attacks by analyzing incoming data for suspicious patterns, thus enhancing web application security [2]. In 2024, [PERSON] et al. presented a machine learning-based detection method using binary Gray-Wolf optimization for feature selection, which enhances detection efficiency by focusing on the most compelling features, achieving high accuracy and precision [23].  
In test prioritization, [PERSON] et al. investigated various techniques to optimize regression testing time in 2018. Based on test distribution analysis, their predictive test prioritization (PTP) method accurately predicts the optimal prioritization technique, significantly improving fault detection and reducing testing costs [27]. [PERSON] et al. studied the combination of diversity-based and history-based test prioritization (DBTP and HBTP) in continuous integration environments, finding that leveraging previous failure knowledge (HBTP) is highly effective. At the same time, DBTP is beneficial during early stages or when combined with HBTP [28]. [PERSON] et al. introduced a method to prioritize security test executions based on web page similarities, hypothesizing that similar pages have similar vulnerabilities. This approach achieved high accuracy in predicting vulnerabilities, speeding up vulnerability assessments, and improving testing efficiency [29]. In 2023, [PERSON] et al. proposed a clustering-based approach to categorize and prioritize code units based on security trustworthiness models. This method helps developers improve code security early in development by identifying code units prone to vulnerabilities, reducing potential vulnerabilities and associated costs [30].  
These studies collectively advance the fields of SQL injection detection and test prioritization, providing robust methodologies to enhance web application security and optimize testing processes. However, to our knowledge, only ART4 SQLi uses test prioritization to boost SQL injection testing.