# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
It instruments the source code of web applications using instrumentation techniques to collect code coverage information of test cases, which then guides the generation of test cases, thereby increasing the exploration of the web application's state space. [PERSON] et al. [37] also designed and implemented a coverage-based gray-box fuzz testing tool for web applications. They placed code in each basic block of the source code to obtain the current execution location during the fuzz testing process. They also created a code analysis tool for JavaScript to analyze whether an alert function call is generated during each fuzz testing process and determine if an XSS vulnerability is successfully triggered based on this condition. Although this technique currently only supports XSS vulnerability detection, their next step is to include SQL injection vulnerability detection. In addition to the above, in dynamic analysis techniques, test case generation is a critical issue, and improving the quality of test cases has been a focus of research. [PERSON] et al. [38] proposed an improvement for the problem of test case scarcity by first constructing a test case generation model using augmented attack trees and then using the model to generate test cases in batches. Although this method effectively solves the problem of test case scarcity, the accuracy of these test cases cannot be guaranteed. [PERSON] et al. [39] proposed an improved approach to enhance the accuracy of test cases. Building on [PERSON]'s method [38], they introduced a model-driven test case generation approach that constructs different models based on different runtime environments. This approach achieves the effect of batch test case generation while maintaining a certain level of accuracy. However, the limitation of this approach is evident as the models are customized based on specific runtime environments and cannot be easily extended. [PERSON] et al. [40], aiming to address the problem of low detection efficiency due to significant biases in test case generation, divided SQL injection vulnerabilities into different levels. Dynamic analysis techniques can analyze program properties, precisely locate vulnerable code, and have a low false positive rate. However, dynamic analysis cannot inspect the entire source code like static analysis does. Reliance on a single execution path can lead to incomplete path coverage and potential false negatives. Our work is based on static analysis. Although static analysis techniques have matured in detecting SQL injection vulnerabilities, they currently cannot accurately detect SQL injection vulnerabilities in applications that utilize OODBE due to the lack of precise modeling for such extensions. Our work addresses this issue by leveraging program transformation techniques, effectively enhancing the capability of static analysis techniques in detecting SQL injection vulnerabilities. ## 7 Conclusions

SQL injection vulnerability detection is essential for web security. The current technique does not accurately detect SQL injection vulnerabilities in applications that apply for object-oriented database extensions. In this paper, we propose a SQL injection vulnerability detection technique based on program transformations. The technique consists of two phases: program transformation and vulnerability detection. In the first stage, object-oriented database extensions are automatically transformed into semantically equivalent program-oriented database extensions. In the second stage, the transformed program is automatically scanned to detect SQL injection vulnerabilities. Based on the above-mentioned techniques, we implemented the OODBE-SCAN prototype system and performed experimental analysis on eight modern PHP applications with this system. Our experimental results show that OODBE-SCAN not only detects more vulnerabilities but also achieves higher accuracy than other static analysis methods. Conceptualization, Y.L. and Y.Y. ; methodology, Y.Y. and K.Z. ; software, Y.Y. ; validation, Y.Y. and Y.L. ; investigation, Y.Y.