An old risk in the new era: SQL injection in cloud environment

Abstract

After haunting all the software engineers for more than 26 years since it was discovered and classified in 2002, SQL injection still poses a most serious threat to developers, maintainers and users of web applications even into the brand new cloud era. SaaS, PaaS and IaaS virtualisation technologies which are widely used by cloud computing seemed to fail the enhancement of security against such an attack. We strive to study the mechanism and principles of SQL injection attack in order to help the information security personnel to understand and manage such risks.