Research and implementation of SQL injection prevention method based on ISR

SQL injection is a major thread to the security of WEB applications. The paper analyzes the weakness of the current solutions to prevent it. It presents a method of preventing SQL injection attacks by ISR (Instruction Set Randomization) and introduces a prototype system based on the method. The system first randomizes the SQL keywords by appending a random integer, then the randomized SQL statement are transmitted to a DBMS proxy, the proxy can find and prevent the SQL injection attack by analysising the syntax, finally the DBMS proxy translates the randomized SQL to the standard SQL statement and send it to DBMS. Experimental results show that this system can effectly prevent SQL injection attack and has low processing cost.