# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 4 Design
### DBE-Converter
#### 4.1.1 Key Statement Identification
CFGBuilder stops parsing nodes when it encounters a stop node. Finally, when all statements are resolved, and all children are added to the base block, the resolution is concluded. During the CFG construction, whenever a statement splits the control flow into new basic blocks, the analysis of a basic block is initiated. Within the base block, the data flow analysis is performed, and the summary of the base block is formed. We traverse all nodes within the base block and analyze assignments, function calls, returns, exits, and other operations. When encountering a node calling a custom function, we create a new CFG to form the function summary. Creating this summary requires a summary of all the basic blocks in the CFG. We initiate a depth-first search for the basic block summaries. If a basic block has no outgoing edges, it either has a return statement or an exit statement, or it is the last block in the CFG. When the search reaches these stopping blocks, it concludes. After the summary of a custom function is completed, its call effect is evaluated by performing an inter-procedural data flow analysis based on its preconditions and postconditions. By constructing the CFG, we obtain all call relations and data streams in the application. By constructing basic blocks and custom function summaries, we achieve efficient backward taint analysis. #### 4.2.2 Taint Analysis

In the second stage, we will perform a backward taint analysis. We trace back each parameter flow to the sink. If the parameter comes from user input, we then perform a context-sensitive data flow analysis on it to check if it has been filtered by a sanitization function. If not, a vulnerability will be reported. In our design, the sanitization function exists in the form of a blacklist. We collect all functions that can block the further spread of taint as a list of sanitization functions. When conducting taint analysis, we check the functions against this list. For example, the addslashes function is used to escape predefinedcharacters by adding backslashes, thereby achieving the effect of quoting. If the single quotes in an SQL statement are quoted, it becomes difficult to perform SQL injection. Once a parameter enters such a function, we consider it to be sanitized and no longer as taint, and the taint analysis is interrupted. The main steps are as follows:

1. Perform backward data flow analysis on the parameters of the sink point. Specifically, we traverse all the base blocks to find those whose summaries match the parameters and have not been sanitized. We collect all the information related to the parameters in the block summary and continue the backward trace through the entry links of the blocks. During the data flow analysis, we collect the results of the processing of the parameters in each base block and summarize them, including their sanitization status;
2. Context-sensitive data flow analysis is performed at the source point. When a parameter arrives at a source point through the data flow analysis, we perform a context-sensitive data flow analysis on it. This is mainly to achieve two goals: to identify the vulnerability type and to check if the sanitization function has processed the parameter. Depending on the vulnerability type, a different analyzer is invoked to identify the context in the tag. Based on the context, specific vulnerability flags are identified. ## 5 Evaluation

In this section, we aim to answer the following research questions through the evaluation of OODBE-SCAN:

RQ1. Can OODBE-SCAN detect more SQL injection vulnerabilities in web applications with OODBE than traditional static analysis techniques (Section 5.2)? RQ2. Are dataflow analysis techniques really effective in improving accuracy (Section 5.3)? ### Setup

We selected eight open-source web applications as our evaluation dataset. We chose these eight PHP applications for three reasons: first, these applications all employ OODBE, such as PDO and mysqli, and encapsulate both types of extensions, which is more in line with our experimental goals.