# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
After the analysis, we found that while Seay supports object-oriented properties, it does not \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline  & \multicolumn{4}{c}{**OODBE-SCAN**} & \multicolumn{4}{c}{**RIPS**} & \multicolumn{4}{c}{**Seay**} \\ \hline application & TP & FP & P & R & TP & FP & P & R & TP & FP & P & R \\ Best POS Management System & 5 & 7 & 0.42 & 0.83 & 0 & 33 & 0 & 0 & 1 & 23 & 0.04 & 0.17 \\ Online Food Ordering System & 5 & 8 & 0.38 & 0.83 & 1 & 26 & 0.04 & 0.17 & 2 & 20 & 0.09 & 0.33 \\ Raffle Draw system & 4 & 2 & 0.67 & 1 & 0 & 0 & 0 & 0 & 3 & 1 & 0.75 & 0.75 \\ Pizza Ordering System & 7 & 9 & 0.44 & 0.88 & 2 & 26 & 0.07 & 0.25 & 2 & 21 & 0.09 & 0.25 \\ Traffic offense & 2 & 3 & 0.4 & 0.67 & 1 & 58 & 0.02 & 0.33 & 2 & 14 & 0.13 & 0.67 \\ Vehicle service & 7 & 12 & 0.37 & 0.88 & 4 & 74 & 0.05 & 0.5 & 5 & 17 & 0.23 & 0.63 \\ Eduauth & 3 & 2 & 0.6 & 0.67 & 0 & 0 & 0 & 0 & 1 & 0 & 1 & 0.33 \\ Judging Management System & 8 & 9 & 0.47 & 0.67 & 0 & 0 & 0 & 0 & 8 & 20 & 0.29 & 0.67 \\ TOTAL & 41 & 52 & 0.44 & 0.82 & 8 & 217 & 0.04 & 0.16 & 24 & 116 & 0.17 & 0.48 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Evaluation results of vulnerability detection. perform data flow analysis specifically for object-oriented types. The \"_admin_class.php_\" file primarily serves the purpose of implementing various functionalities by defining a class for convenient instantiation in other files, and therefore, it is not a sink point. From a theoretical point of view, Seay is prone to contamination diffusion during static analysis. This is because Seay does not perform precise data flow analysis but instead relies on regular expression matching. For example, in \"\(\deltaconn->query()\)\", it only matches the \"\(query()\)\" method without considering the calling object \"\(conn\)\". This strategy leads to contamination diffusion and results in a large number of false positives. Only through accurate data flow analysis and call relationship analysis can such functions be excluded. Additionally, Seay seems to have inadequate modeling of sanitization functions. In the \"_Master_\" file of the \"\(traffic\_offense\) 1.0\" application, during the propagation process, the \"\(\delta\)\" variable is sanitized by the \"_addslashes_\" function before entering the sink point. Based on the experimental results(which is listed in Table 2) and our analysis work, the answer to RQ2 is also certain. Compared with Seay, OODBE-SCAN reports significantly fewer false positives. The application of data flow analysis technology enables OODBE-SCAN to accurately locate the called objects of methods, avoiding the spread of contamination and improving the accuracy of vulnerability detection. In addition to presenting the experimental data of the two experiments in Table 2, we used Figures 3 and 4 to display the comparison of the TP and FP discovered by three tools in the same dataset, respectively, to make the results more clear. OODBE-SCAN reported a total of 52 false positives, and the main reason for these false positives is that our tool is based on the implementation of RIPS, which has inherent design flaws. The improvements we made mainly focused on the program transformation part, and we did not make significant changes to the vulnerability scanning logic of RIPS. In summary, there are three main reasons for the false positives:

1. Path-insensitive data flow analysis;
2. Sanitization through database whitelist
3. Wrong content-type

Figure 3: Comparison chart of real vulnerabilities detected by three tools in the dataset. For example, in the application \"_Best POS Management System\"_, there is the following code segment:
```
1 functionsani_string($string,$i=false){
2 if($i==true){
3 returnaddslashes($string);
4}else{
5 return$string;
6}
7}
```

The user-defined function sanitizes the first argument based on the value of the second argument.