# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
On the other hand, dynamic analysis-based vulnerability mining techniques require constructing an appropriate code execution environment for the web application and conducting analysis under the prerequisite of successful execution. In the following discussion, we will explore the relevant works and their notable limitations. Static analysis methods refer to the analysis of web application code without executing it, primarily leveraging code syntax and semantic features such as AST, CFG, and call flow graphs to match vulnerability patterns and discover vulnerabilities. PhpSAFE [5] is specifically designed to analyze security vulnerabilities in plugins developed for PHP-based content management systems (CMS) and can detect SQL injection vulnerabilities in these plugins. However, PhpSAFE is highly customized for detecting vulnerabilities specific to CMS plugins, which may limit its utility for analyzing other types of PHP projects. PIXY [4] is an open-source tool specifically designed for statically detecting tainted vulnerabilities in PHP programs, thus having the capability to detect SQL injection vulnerabilities. However, it has limited capabilities as it only supports PHP 4 and earlier versions and cannot analyze object-oriented programming features introduced in subsequent language versions. This means that PIXY produces a significant number of false negatives, rendering its analysis results unreliable. RIPS [3] is a static analysis tool specifically designed for detecting security vulnerabilities in PHP code. It can analyze all types of vulnerabilities in PHP code, including SQL injection vulnerabilities. RIPS uses the PHP Zend engine syntax parser to obtain token flow information from the source code, based on which it generates corresponding AST and CFG. However, RIPS does not support the analysis of object-oriented programming PHPcode; therefore, it cannot detect SQL injection vulnerabilities in applications that utilize object-oriented database extensions. Seay [15] can detect common web application vulnerabilities, including SQL injection vulnerabilities, and generate detailed reports to help users identify and fix these security issues. Moreover, Seay supports customizable rules and plugins, allowing for flexible configuration and extension based on user requirements. It also provides command-line and web interfaces, supporting interactive operations and scanning. However, Seay performs poorly in supporting object-oriented features and often generates a significant number of false positives during vulnerability detection. Dynamic analysis techniques require the actual execution of the program. After setting up the program's runtime environment, debugging, fuzz testing, and simulating attacks are performed with the premise of successful program execution. Relevant vulnerabilities are then discovered based on the output results. [PERSON] et al. [35] proposed a black-box fuzz testing method for automatically testing SQL injection vulnerabilities in real-world scenarios of web applications. They integrated and simulated web browser functionality within their crawler to enable testing of web applications in real-world scenarios. The crawler utilizes a \"comprehensive crawling\" mechanism to reverse-engineer web applications and identify all data input points. Self-learning is employed to inject knowledge into the knowledge base, and fault injection techniques are used to detect SQL injection vulnerabilities. However, black-box fuzz testing relies on manually managed lists of inputs that trigger vulnerabilities, which significantly reduces the ability of black-box scanners to explore the input space of web applications and may result in false negatives. Addressing this issue, inspired by gray-box coverage-guided fuzz testing, [PERSON] et al. [36] proposed a gray-box fuzz testing technique for web applications.