CANDID: preventing sql injection attacks using dynamic candidate evaluations
a classification of sql - injection attacks and countermeasures .