# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification  
First, the DBE-converter needs to identify the database extension used by the application program and find the object variables instantiated by the database extension class as source points. In this paper, we focus on the analysis of MySQLi and PDO, which are currently the most widely used types of database extensions. Application programs may directly use these two types of database extensions. Then, all potential sink points are identified. In terms of design details, PHP-parser is used to parse the application source code into an AST, and all AST nodes in the project are traversed in depth. First, nodes with all class labels are filtered out. Then, these nodes are analyzed: (1) If the \"name\" attribute in  
Figure 2: The overall architecture of OODBE-SCAN. the tag is MySQLi or PDO, backward analysis is performed to see if the previous node is a tag with the keyword \"new\". If so, this indicates that the application program directly uses both types of database extensions; (2) If the \"extends\" attribute in the tag is MySQLi (PDO cannot be inherited), forward analysis is performed from this tag. If there is a \"new\" node after the class tag, it indicates that the application program creates a new class that inherits MySQLi; (3) If MySQLi or PDO is wrapped, the object instantiated with MySQLi or PDO will be assigned to a property of the new class, such as \(\$this\gets conn=newmsgsli\), as long as the label to the left of the equal sign is calling an object property, to the right is the label to instantiate MySQLi. The objects instantiated by the database extension class are the source points.  
Then, we traverse the AST nodes and use regular expression matching to find all statements in the source code that call sensitive operation methods (e.g., \"\(\rightarrow\)query(0)\") as potential sink points and perform backward analysis on them. The algorithm implementation is shown in Algorithm 1. In the process of finding source points, we use a depth-first traversal algorithm and perform backward tracing for nodes that partially meet the judgment conditions at most twice, so the algorithm complexity is O(n). In the process of finding sink points, we use regular expression matching based on traversing all nodes, so the algorithm complexity is also O(n). Overall, the algorithm complexity of Algorithm 1 is O(n). The implementation algorithm is shown in Algorithm 1.  
```
Input: sourcecode \(P\) Output:\(Source\{\}\): A set contains the object instantiated by a class in a database extension, \(Sink\{\}\):A set contains the query() method called by the object instantiated by the class in the database extension
1\(Nodes_{(AST)}\{\}\leftarrow\) PHP_Parser(\(P\))
2\(Nodes_{(AST,class)}\{\}\leftarrow\) DFS(\(Nodes_{(AST)}\)) // Perform a depth-first traversal of all AST nodes. for\(N_{i}\in Nodes_{(AST,class)}\{\}\)do // Perform a depth-first traversal of all AST nodes representing classes. if\(N_{i}(name)\in\{



#### 4.1.2 Call Relation Verification

We draw on the ideas of taint analysis in our approach to monitor the state of variables and capture changes in variable properties during transmission through data flow analysis techniques [26].

In the first PART, we used regular expression matching to match the object's methods \" \(\rightarrow\)_query_\" in the source program, and mark their positions. We regarded the object variable instantiated by the database extension class as the source point (e.g., \(\$conn=new\ mysali()\)). Then, we performed backward data flow analysis on each sink point, starting from the \"\(x\rightarrow\)_query_\" node (since we did not know the state of \"\(x\)\" at this time, we used \"\(x\)\" to represent it). We monitor the change in the state of the variables during data transmission based on the taint propagation rule and stop until the source point is encountered.