Proposing SQL Statement Coverage Metrics: Difference between revisions
Programsam (talk | contribs) |
Programsam (talk | contribs) |
||
| Line 94: | Line 94: | ||
} | } | ||
<center> | <center>'''Figure 6. Example authentication persistence'''</center> | ||
A countermeasure for the form input field vulnerability is simply to escape all control characters (such as ‘ or #) from the input variables. For the cookie vulnerability, a countermeasure would be to dynamically generate a unique identifier for the current session and store that in the cookie as well as the associated user role. Because these vulnerabilities can be prevented with input validation, they are known as input validation vulnerabilities. Figure 6 is not a SQL injection attack; however it still represents an input validation vulnerability. We have included it here in the interest of completeness, but we will not focus on this type of vulnerability in the rest of this paper. | |||
Although a number of techniques exist to mitigate the risks posed by SQL injection vulnerabilities<sup>[2, 6, 8, 9, 13, 14]</sup>, none of these techniques propose a methodology of adequacy as ensured by measuring how many commands issued to a database management system are tested by the test suite. | |||
== 9. References == | == 9. References == | ||