Designing an Integrated System for SQL Injection Detection and Prevention Using a Machine Learning-Based Web Exploration Application

Structured Query Language (SQL) injection is one of the most prevalent and pernicious web application security issues that can lead to unauthorized data access, modification and loss. While Machine Learning (ML) approaches have shown promise in detecting SQL injection attacks, many existing studies exhibit significant shortcomings. These limitations often include a lack of integration into real-time web applications for evaluation, a failure to update datasets with new or unseen user inputs and feature engineering that does not always consider all tokens, including special characters crucial for identifying injection syntax. This paper presents the design, development and evaluation of an integrated system that addresses these gaps by detecting and preventing SQL injections using a robust ML model integrated within an exploratory web application. Several ML models, including Multinomial Naïve Bayes, Random Forest Classifier and AdaBoost Classifier, in combination with different data vectorization methods like CountVectorizer and TfidfVectorizer, have all been evaluated. Based on the analysis of the results, the Random Forest Classifier paired with TfidfVectorizer, which considers all tokens, achieved the highest accuracy of 99.10%. This model serves as the core of our SQL injection detection system, which is uniquely integrated into a real-time web application to assess its performance with various user inputs. The successfully implemented system demonstrates its effectiveness by detecting malicious inputs and preventing the execution of injected SQL queries in a live environment.