# Detection of SQL Injection Attack Using Machine Learning Techniques: A Systematic Literature Review
###### Abstract  
An SQL injection attack, usually occur when the attacker(s) modify, delete, read, and copy data from database servers and are among the most damaging of web application attacks. A successful SQL injection attack can affect all aspects of security, including confidentiality, integrity, and data availability. SQL (structured query language) is used to represent queries to database management systems. Detection and deterrence of SQL injection attacks, for which techniques from different areas can be applied to improve the detect ability of the attack, is not a new area of research but it is still relevant. Artificial intelligence and machine learning techniques have been tested and used to control SQL injection attacks, showing promising results. The main contribution of this paper is to cover relevant work related to different machine learning and deep learning models used to detect SQL injection attacks. With this systematic review, we aims to keep researchers up-to-date and contribute to the understanding of the intersection between SQL injection attacks and the artificial intelligence field. SQL injection; machine learning; deep learning; adversarial attacks +
Footnote †: journal: Cybersecurity and Privacy  
0000-0001-9999-4000-0000-0000-0000-0000-0000-0000-0000-0000-0000-00000-0000-0  
in authentication and bypass and changes to the database by inserting, modifying, and/or deleting data, causing data loss and/or destruction of the entire database. Furthermore, such an attack could overrun and execute commands on the hosted operating system, typically leading to more serious consequences [4]. Thus, SQL injection attacks present aserious threats to organizations. A variety of research has been undertaken to address this threat, presenting various artificial intelligence (AI)techniques for detection of SQL injection attacks using machine learning and deep learning models [5]. AI techniques to facilitate the detection of threats are usually implemented via learning from historical data representing an attack and/or normal data. Historical data are useful for learning, in order to recognize patterns of attacks, understanding detected traffic, and even predicting future attacks before they occur [6]. SQL injection attackers and defenders must understand how SQL language works to know how it can be misused [3]. To extract data from a database or modify the data, queries must be written using SQL language and they must follow a standard syntax, such as:  
\"SELECT * FROM books WHERE author = \"MAHA\"  
The above query will return all books authored by MAHA. Queries are submitted to the DBMS and are usually written through a web browser. For the query to be transmitted to the database server through the web browser, it has to be encoded through a long URL string, such as: [[http://www.xyz_website.com?QUERY=SELECT%20](http://www.xyz_website.com?QUERY=SELECT%20)]([http://www.xyz_website.com?QUERY=SELECT%20](http://www.xyz_website.com?QUERY=SELECT%20))*%20 FROM%20 books%20 WHERE%20 author=7453. What if the attacker adds to the previous SQL query? For example:  
\"SELECT * FROM books WHERE author = \"MAHA' OR '1' = '1' \"  
As the statement 1 = 1 is always true, the query will return all books in the database, not just the books authored by MAHA. The previous example might not represent a threat, especially if the stored list of books is not confidential. However, it could be applied to valuable using different syntax, and if successful, it might return sensitive data, such as passwords, bank accounts, trade secrets, and personal data, which might be considered a privacy breach, among other consequences. In some research, injecting a code using 'OR' followed by a TRUE statement, such as 1 = 1 is called \"tautology\" [7].