# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 3 Motivating Example  
In this section, we analyze the limitations of the current technique through specific examples, as shown in the Figure 1. OODBE primarily utilizes an object-oriented programming style. In Figure 1b, the mysqli database extension class is instantiated as an object and assigned to the variable \(\$conn\) (line 2). Subsequently, database operations are performed by directly invoking methods on this object variable. By calling the query method of \(\$conn\), various operations on the database can be performed (in this example, we have chosen the most common select operation for injection attacks), and the result is assigned to the variable \(\$user\) (line 4). Process 1 depicts this process. In Figure 1c, the application encapsulates the mysqli database extension within a new class called DBConnection (line 2). Within this class, an attribute \(\$conn\) is defined (line 3), and the instantiated mysqli database extension object is assigned to the \(\$conn\) attribute (line 6). Finally, the methods of the \(\$conn\) attribute are invoked to execute database query operations (line 8). Process 2 represents this process. Figure 1 illustrates an example of an SQL injection attack on a web application that utilizes OODBE. In Figure 1a, an attacker sends malicious input through a text box on the website (via the '\(\mathit{id}\)' parameter). As shown in Figure 1b, the server-side program is vulnerable to the attack because it directly passes the input to the invoked method \(\$conn\to query()\), which executes the injected command (line 4). Process 3 depicts this process. Similarly, Figure 1c demonstrates another susceptible code segment with the same vulnerability principle. Process 4 represents the attack process.  
Due to the lack of comprehensive and accurate modeling of OODBE [3; 10; 12], existing static analysis techniques are unable to effectively detect SQL injection vulnerabilities in this class of extensions. Taking the classic static analysis tool RIPS as an example, its vulnerability detection process is based on tracing parameters backward from sink functions. However, in applications using mysqli and PDO database extensions, sink functions often appear in an object-oriented encoding form. For example, \(\$conn=new\ mysqli();\$conn\to query()\), where \(\$conn\) is an object instantiated from the mysqli class, and query() is a method within the \(\$conn\) object. By calling methods within an object to perform various operations, such as select, insert, and update, etc. Since RIPS does not model this type of data, it cannot identify \(\$conn\to query()\). Without finding the sink function, the static analysis cannot proceed, resulting in a significant number of false negatives. Some static analysis techniques may already model object-oriented data types, but their lack of precision greatly affects the efficiency of discovering SQL injection vulnerabilities [13; 14; 15]. For example, the static analysis tool Seay employs a regular expression matching strategy to find the sink function [25]. In the case of \(\$conn\to query()\), although the method \(\$conn\to query()\) is matched, it fails to determine which class the object \(\$conn\) is instantiated from. This strategy leads to contamination propagation and a large number of false positives. In summary, the limitations of current static analysis techniques boil down to two main points:  
1. Existing static analysis techniques do not model object-oriented data types, which leads to the inability to find sink points in web applications that utilize OODBE. As a result, static analysis cannot proceed properly, leading to a significant number of false negatives;
2. A few static analysis techniques have modeled object-oriented data types, but they use regular expression matching to find sink functions. They only match the object and the called method (e.g., \(obj\to f()\)) without determining which class instantiated the object, causing contamination propagation and resulting in numerous false positives.