# A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation
## 1 Introduction  
SQL injection vulnerability detection has become a research hot spot in information security [1]. Currently, the mainstream approach is to use static analysis techniques to detect SQL injection vulnerabilities. Static analysis technology refers to analyzing web application code without executing it, mainly relying on syntax and semantic features, such as abstract syntax tree (AST), control flow graph (CFG), and call flow graph, matching according to the characteristics of vulnerabilities to discover them [2]. After a long development, static analysis techniques have become increasingly mature and have been used to automate the detection of SQL injection vulnerabilities with certain results [3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. However, existing static analysis techniques cannot accurately detect SQL injection vulnerabilities in applications that use object-oriented database extension (OODBE).  
An OODBE is a type of database that applies an object-oriented programming style. The object-oriented programming style was introduced in PHP 5. The core features of PHP object-oriented programming include class, object, encapsulation, inheritance, and polymorphism, which have strong dynamism and flexibility. In our study, we investigated existing solutions of static analysis tools and identified that their inability to effectively and accurately detect SQL injection vulnerabilities in applications utilizing OODBE is mainly due to their lack of modeling for OODBE or their use of regular expression matching to detect vulnerabilities [3, 10, 12, 13, 14, 15, 16]. As a result, existing techniques fail to accuratelydetermine the object involved in method calls (e.g., \(\$obj\) in \(\$obj\to f()\)), leading to false negatives, or they may only match method names (e.g., \(f()\) in \(\$obj\to f()\)), resulting in false positives.  
We propose a program transformation-based SQL injection vulnerability detection technique to address this issue, which consists of two stages: program transformation and vulnerability detection. The first stage is divided into three parts. The first part is to automatically identify the database extension and search for the source points (in our technique, referring to the instantiation of a database extension class into an object) and sink points (in our technique, referring to sensitive operations in the database extension, such as (\(\$conn\to query\)).  
In the second part, data flow analysis is performed to determine the relation of method calls. The third part performs a program transformation to convert the key statements identified in the first two parts from an object-oriented programming style to a procedural programming style, automatically converting an OODBE to a semantically equivalent procedural database extension. The second stage is divided into two parts. The first part constructs a control flow graph to generate basic blocks and function summaries to model the entire application framework. In the second part, taint analysis techniques are applied to automatically scan application programs to detect SQL injection vulnerabilities. A prototype system, OODBE-SCAN, was developed based on the techniques. We conduct a comprehensive evaluation of OODBE-SCAN on a dataset containing eight representative PHP applications. Experimental results demonstrate the capability of OODBE-SCAN to detect SQL injection vulnerabilities in applications using OODBE. We also compare OODBE-SCAN with the existing static analysis tools RIPS [3] and Seay [15], and the experimental results show that OODBE-SCAN can not only detect more SQL injection vulnerabilities but also with higher accuracy.