# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
If the object variable instantiated by the database extension class is transmitted to \"\(x\)\", it indicates that \"\(x\)\" is also an object, and its state equals the state of the object instantiated by the database extension class, then \"\(x\rightarrow\)_query_\" is a true sink point. The implementation algorithm is shown in Algorithm 2. ```
Input:\(Source\{\}\): A set contains the object instantiated by a class in a database extension, \(Sink\{\}\):A set contains the query() method called by the object instantiated by the class in the database extension Output:\(Tainted\)[ ]: Tainted information for\(sink\in Sink\{\}\)do \(current\_node\leftarrowsink\) // Assign the current sink point to the variable current_node. while\(current\_node\
otin Source\{\}\)do predecessor\(node\leftarrowGet\_predecessor(current\_node)\) // Backward Analysis. if\(Operation(current\_node,predecessor\_node)=='='then current_node\(\leftarrow\)predecessor_node  
end if else break  
end if // If there is an assignment operation between the current node and the previous node, continue with the backward analysis; otherwise, terminate immediately. ifcurrent_node is the first nodethen & current_node\(\in Source\{\}\)  end if // If the current node is the first node and it is in the set Source. Tainted[ ]\(\leftarrow\)sink // Indicate that the sink node is a valid sink point and add it to Tainted[ ]. end if return\(Tainted\)[ ]\(\Box\)
```
**Algorithm 2**data flow analysis

#### 4.1.3 Program Transformation

After the call relations are determined, we mark the key statements. Key statements include the statements for instantiating the database extension class (which we call source points) and calling methods in the object (which we call sink points). We will transform the object-oriented programming style of key statements into a procedural programming style. Typically, we transform the source point: \"\(\mathcal{S}conn=new\;\;mysqli\) (\"localhost\", \"username\", \"password\", \"database\")\" into \"\(\mathcal{S}link=mysqli\_connect(\"localhost\",\"username\", \"password\", \"database\")\"\). Then, various operations of the sink points will also be translated into corresponding procedural statements. The select query statement: \"\(\mathcal{S}result=\mathcal{S}conn\to query(\"SELECT*FROM\;\;users^{\prime})\)\" will be transformed into \"\(result=mysqli\_query\) (\(\mathcal{S}link\), \"\(SELECT*FROM\;\;users^{\prime})\)\"; the insert query statement: \"\(\mathcal{S}save=\mathcal{S}this\to db\to query\) (\"\(INSERT\;\;INTO\;orders\;\;set\;\mathcal{S}date^{\prime}\)\") will be transformed into \"\(query=\"INSERT\;\;INTO\;orders\;\;set\;\mathcal{S}data\"\); \(\mathcal{S}save=mysqli\_query(\mathcal{S}link,\mathcal{S}query)\)\". The remaining transformation operations are similar, and we will not go into further details here. ### Vulnerability Scanner

The source code converted by the DBE-converter will be fed into the vulnerability scanner section to detect SQL injection vulnerabilities. This process consists of two main phases. The first stage is to construct the CFG; the second stage is a taint analysis based on CFG. #### 4.2.1 Build Control Flow Graph

In the first stage, the AST is first divided into a main AST and a custom function AST. CFG is constructed based on the main AST. When a skip node is encountered, a new basic block is created, and the data flow analysis is performed within the basic block to form a summary of the basic block. When a call node for a custom function is encountered, a new CFG is constructed based on the AST of the custom function, and a function summary is similarly formed using data flow analysis. In terms of the specific implementation, CFGBuilder first creates a new BasicBlock and stores it as the current block. It then loops through all the root nodes of the AST and adds all non-statement nodes to the list of current block nodes. If a jump statement (JSTMT) is detected, a new CFGBuilder is started, and the new current block is linked to the previous current block.