Patent ID: 8010522

Claim:
A method for detecting a malicious Structured Query Language (“SQL”) query injected into a parameter value field of a request, the method comprising the steps of: a computer searching the parameter value field for (a) query commands of a first plurality and (b) combinations of two or more query commands, the two or more query commands of each of the combinations being different than each other and different than the query commands of the first plurality, and finding in the parameter value field at least one of the query commands of the first plurality and at least one of the combinations, each of the query commands of the first plurality and each of the combinations having respective, assigned scores indicating, at least in part, respective likelihoods that the SQL query is malicious; the computer adding the respective scores of the at least one query command of the first plurality and the at least one combination; the computer determining if a total of the added scores exceeds a predetermined threshold, and if so, the computer preventing execution of the request, and wherein the query commands of the first plurality are respective keywords and the two or more query commands of the combinations are respective keywords; and wherein scores are not assigned separately to the respective query commands of the combinations such that if one, but not all, the query commands of one of the combinations is found in the parameter value field the one query command does not add to the total which is compared to the predetermined threshold.