Patent Document ID: 7487149
Application ID: 10800315

Base Claim:
1. A method for using query signatures to detect structured query language (SQL) injection, comprising: initializing a signature cache, wherein initializing the signature cache involves: trapping database queries in a controlled environment, parsing the database queries to produce a set of valid signatures, wherein parsing the database queries involves retaining SQL keywords contained in each query, and removing field names and corresponding values in each query, to determine the signature for each query; wherein the signature for a query contains the text of SQL keywords and operands without any field name or value in the query, and storing the valid signatures in the signature cache; receiving a query at the database; parsing the query at the database to determine a signature for the query, wherein the signature comprises SQL keywords contained in the corresponding query with literals removed; determining if the signature is located in the signature cache, which contains signatures for valid queries; and if so, allowing the corresponding SQL query to proceed, otherwise, triggering a mismatch alert.

---

Claim 4:
4. The method of claim 1 , wherein the mismatch alert is sent to a requesting application, thereby allowing the requesting application to take action.