SQLiShield: A Multi-Layer SQL Injection Detection and Prevention Framework

SQL Injection (SQLi) continues to rank among the most exploited vulnerabilities in web applications globally, appearing in the OWASP Top 10 for over two decades. This paper presents SQLiShield, a novel multi-layer detection and prevention middleware engineered for Python/Flask web applications. SQLiShield fuses three hierarchical protection layers: a deterministic engine of 53 pre-compiled regular expression patterns (Layer 1), an adaptive Random Forest ML classifier trained on 6,941 labeled payload samples (Layer 2), and a structural input sanitization fallback (Layer 3). The framework is deployed as a Flask before_request hook, transparently intercepting all GET parameters, POST form fields, JSON bodies, and HTTP cookies before they reach application logic. Empirical evaluation using the Kaggle SQL Injection Dataset demonstrates that the combined multi-layer architecture achieves 99.2% detection accuracy, 99.5% precision, 98.8% recall, and a 0.5% false positive rate — substantially outperforming standalone regex (87.0%, 18% FPR) and standalone ML (97.3%, 1.8% FPR). End-to-end detection latency averages 3.7 ms per request. Automated penetration testing with SQLMap across 100 obfuscated payloads yielded zero successful bypasses. A companion Flask demonstration application exposes four intentionally vulnerable endpoints — authentication bypass, UNION-based extraction, secondorder injection, and a real-time admin dashboard — enabling controlled side-by-side comparison of protected and unprotected execution paths.