Authors:
Francesco Di Tria
;
Ezio Lefons
and
Filippo Tangorra
Affiliation:
Università degli Studi di Bari Aldo Moro, Italy
Keyword(s):
SQL Injection, Authentication, Authorization, Web Application, Architecture.
Related
Ontology
Subjects/Areas/Topics:
Data and Application Security and Privacy
;
Database Security
;
Information and Systems Security
Abstract:
In web applications, databases are generally used as data repositories, where a server-side program interacts with a Database Management System (DBMS), retrieves content, and dynamically generates web pages. This is known as a three-layer architecture, that is widely exposed to database threats. The attacks are usually performed through the injection of SQL code in the forms of the web applications, exploiting the dynamic construction of SQL statements. So, the database security relies on the quality of the code and the controls done by the web developer in the application level. In this paper, we present a solution for the improvement of security of databases accessed by web applications. The security is based on a user modelling approach that completely relies on the authorization mechanism of DBMSs.