A method for protection against database injection attacks, the method comprising: intercepting a first database query prior to being executed by a database management system (DBMS); determining whether the first database query is found in an allowed query list; in response to determining that the first database query is not found in the allowed query list, determining whether the first database query is suspected of having a security threat of a database injection attack by comparing the first database query with past database queries that have been intercepted prior to the interception of the first database query, wherein comparing the current database query with the past database queries comprises: identifying a potential injection spot of in a given past database query of the past database queries, wherein the potential injection spot corresponds to a string literal or a constant number of the given past database query; and determining that the first database query is suspected of having the security threat of the database injection attack if the given past database query could be transformed into the current database query by injecting data into the past database query at the potential injection spot; in response to determining that the first database query is not suspected of having the security threat of the database injection attack, storing the first database query in the allowed query list; intercepting a second database query prior to being executed by the database management system (DBMS); determining whether the second database query is found in the allowed query list; and in response to determining that the second database query is found in the allowed query list, causing the second database query to be executed by the DBMS. intercepting a first database query prior to being executed by a database management system (DBMS); determining whether the first database query is found in an allowed query list; in response to determining that the first database query is not found in the allowed query list, determining whether the first database query is suspected of having a security threat of a database injection attack by comparing the first database query with past database queries that have been intercepted prior to the interception of the first database query, wherein comparing the current database query with the past database queries comprises: identifying a potential injection spot of in a given past database query of the past database queries, wherein the potential injection spot corresponds to a string literal or a constant number of the given past database query; and determining that the first database query is suspected of having the security threat of the database injection attack if the given past database query could be transformed into the current database query by injecting data into the past database query at the potential injection spot; identifying a potential injection spot of in a given past database query of the past database queries, wherein the potential injection spot corresponds to a string literal or a constant number of the given past database query; and determining that the first database query is suspected of having the security threat of the database injection attack if the given past database query could be transformed into the current database query by injecting data into the past database query at the potential injection spot; in response to determining that the first database query is not suspected of having the security threat of the database injection attack, storing the first database query in the allowed query list; intercepting a second database query prior to being executed by the database management system (DBMS); determining whether the second database query is found in the allowed query list; and in response to determining that the second database query is found in the allowed query list, causing the second database query to be executed by the DBMS.