SQLiShield: A Multi-Layer SQL Injection Detection and Prevention Framework
Combining Deterministic Regex Matching with Adaptive Machine Learning for Real-Time Web Application Protection
SQLiShield Framework — Student Authors
Patel Vishwa Mehulkumar | Chetan Ravindra Vashiste | Heet Patel
B.Tech Computer Science and Engineering
Parul Institute of Technology, Parul University, Gujarat, India
SQLiShield Framework — Project Guides
Dr. Vivek Tiwari | Mr. Dinesh Kumar Cholkar | Ms. Riddhi Atulkumar Mehta
Department of Computer Science and Engineering, Parul Institute of Technology, Parul University, Gujarat, India
Abstract
SQL Injection (SQLi) continues to rank among the most exploited vulnerabilities in web applications globally, appearing in the OWASP Top 10 for over two decades. This paper presents SQLiShield, a novel multi-layer detection and prevention middleware engineered for Python/Flask web applications. SQLiShield fuses three hierarchical protection layers: a deterministic engine of 53 pre-compiled regular expression patterns (Layer 1), an adaptive Random Forest ML classifier trained on 6,941 labeled payload samples (Layer 2), and a structural input sanitization fallback (Layer 3). The framework is deployed as a Flask before_request hook, transparently intercepting all GET parameters, POST form fields, JSON bodies, and HTTP cookies before they reach application logic.
Empirical evaluation using the Kaggle SQL Injection Dataset demonstrates that the combined multi-layer architecture achieves 99.2% detection accuracy, 99.5% precision, 98.8% recall, and a 0.5% false positive rate — substantially outperforming standalone regex (87.0%, 18% FPR) and standalone ML (97.3%, 1.8% FPR). End-to-end detection latency averages 3.7 ms per request. Automated penetration testing with SQLMap across 100 obfuscated payloads yielded zero successful bypasses. A companion Flask demonstration application exposes four intentionally vulnerable endpoints — authentication bypass, UNION-based extraction, secondorder injection, and a real-time admin dashboard — enabling controlled side-by-side comparison of protected and unprotected execution paths.
Keywords: SQL Injection, SQLiShield, Random Forest, Web Application Firewall, Flask Middleware, OWASP, Intrusion Detection, Regex Pattern Matching, Parameterized Queries, Defense-in-Depth, Parul University
