Diversifying SQL to Prevent Injection Attacks

This paper proposes an idea of diversification to make SQL resistant against injection attacks. Our solution is based on a novel two-layered approach. It allows the SQL server to support several different instruction sets so that the SQL symbols used by every application are different. The internal SQL symbols used by the server are also uniquely diversified. We also tested our approach by applying it to MySQL server. We show that it prevents several injection attacks that earlier proxy-based solutions cannot catch. Because our solution only quickly decodes the randomized SQL symbols in the query when it arrives to the server, it does not cause any significant performance losses contrary to a proxy-based solution. The queries in applications that use the SQL server need to be diversified accordingly, but this could be done automatically to a great extent.