# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
Due to RIPS's path-insensitive data flow analysis and function summary-based approach, it mistakenly incorporates two possible return values into the function summary, resulting in always returning the same result regardless of the value of the second parameter. ## 6 Discussion

OODBE-SCAN is a static analysis tool that automatically transforms OODBE into semantically equivalent procedural database extensions. It scans the transformed programs to detect SQL injection vulnerabilities. Compared to other static analysis tools, OODBE-SCAN not only detects more vulnerabilities but also achieves higher accuracy. ### Cost-Effectiveness and Scalability

Our strategy ensures that our technique is highly cost-effectiveness. When performing program transformation, we prioritize the identification of source points and sink points, which are directly related to vulnerabilities. Our algorithm primarily involves deep traversal and regular matching, resulting in a complexity of O(n). Through program transformation technology, our tool can discover a large number of SQL injection vulnerabilities that RIPS and Seay cannot find. Within the same time, OODBE-SCAN discovered 41 real vulnerabilities, while RIPS only discovered 8 and Seay only discovered 24. Our technique exhibits high scalability. Firstly, we incorporated program transformation techniques into RIPS, which have a low algorithmic complexity of O(n). The overhead is minimal. Additionally, RIPS itself is applicable to large-scale real-world programs, which means our approach is also suitable for such programs. Secondly, our technology focuses on database extensions, so any scale of real-world application, as long as it applies object-oriented database extensions, we can process it. Figure 4: Comparison chart of false positive detected by three tools in the dataset. ### Limitation

1. To some extent, program transformation technique serve as auxiliary method for vulnerability detection. The effectiveness of our technique in detecting SQL injection vulnerabilities heavily relies on the SQL injection detection capabilities of existing static analysis techniques. Because the fundamental purpose of proposing program transformation technique is to automatically transform object-oriented database extensions into semantically equivalent procedural database extensions. This transformation helps existing static analysis techniques accurately detect SQL injection vulnerabilities in applications that utilize object-oriented databases. 2. Our program transformation technique currently relies heavily on the knowledge of researchers. If complex semantic code is encountered, the automatic transformation may not access ideal results, which can affect the final vulnerability detection. ### Future Work

1. Although OODBE-SCAN has performed well in evaluations, we have identified potential improvements. Currently, our program transformation technique relies heavily on the knowledge of the researcher. In terms of understanding code semantics, the large language models(LLMs) have shown impressive performance. Some aspects of our work are entirely dependent on LLMs and they have even helped optimize our work. If we encounter complex semantics, leveraging LLMs for understanding may access better results. 2. Our technique not only enables vulnerability discovery but also has the potential to be combined with other security techniques to enhance the vulnerability detection process. For example, it can be integrated with fuzzing. ### Related Work

In recent years, extensive research has been conducted by scholars worldwide on detecting SQL injection vulnerabilities [3; 4; 5; 27; 28; 29; 30; 15]. This research primarily focuses on two approaches: vulnerability mining techniques based on static analysis and vulnerability mining techniques based on dynamic analysis. Static analysis-based vulnerability mining techniques involve analyzing the code without running the web application.