A Survey on Hybrid SQL Injection Detection: Feature-Selection, Classical Machine Learning, and Deep Learning Approaches to Obfuscated, Blind, and Time-Based SQLi

SQL Injection (SQLi) remains one of the most persistent and damaging classes of web application vulnerabilities. As attackers adopt more sophisticated techniques — obfuscation, blind channels, and time-based inference — traditional detection techniques (rule/signature based and shallow ML) show limited robustness. Recently, hybrid approaches that combine feature selection, classical machine learning (ML) for fast filtering, and deep learning (DL) for semantic verification have gained traction. This survey thoroughly analyzes contemporary SQL Injection (SQLi) detection methods, specifically focusing on hybrid architectures capable of identifying obfuscated, blind, and time-based variants. This section details the SQLi attack taxonomy and corresponding defensive mechanisms. It further explores the application of advanced feature engineering techniques, such as Chi-Square ranking, to enhance detection. The analysis concludes with a performance evaluation (benchmarking) of both Machine Learning (ML) and Deep Learning (DL) models employed in this security domain.