{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,31]],"date-time":"2025-05-31T06:22:58Z","timestamp":1748672578454,"version":"3.40.3"},"publisher-location":"Cham","reference-count":19,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319049144"},{"type":"electronic","value":"9783319049151"}],"license":[{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-319-04915-1_11","type":"book-chapter","created":{"date-parts":[[2014,2,20]],"date-time":"2014-02-20T15:12:22Z","timestamp":1392909142000},"page":"154-165","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Detection Method of the Second-Order SQL Injection in Web Applications"],"prefix":"10.1007","author":[{"given":"Lu","family":"Yan","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaohong","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ruitao","family":"Feng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiyong","family":"Feng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jing","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2014,2,21]]},"reference":[{"key":"11_CR1","unstructured":"2011 CWE\/SANS Top 25 Most Dangerous Software Errors. http:\/\/cwe.mitre.org\/top25\/index.html"},{"key":"11_CR2","unstructured":"OWASP TOP 10 \u2013 2013: The ten most critical web application security risks. https:\/\/www.owasp.org\/index.php\/Top_10#OWASP_Top_10_for_2013"},{"key":"11_CR3","unstructured":"Ollmann, G.: Second-order code injection attacks. Technical report. NGSSoftware Insight Security Research (2004)"},{"key":"11_CR4","volume-title":"SQL Injection Attacks and Defense","author":"C Justin","year":"2009","unstructured":"Justin, C.: SQL Injection Attacks and Defense. Syngress Publishing Inc., Boston (2009)"},{"key":"11_CR5","unstructured":"Livshits, V.B., Lam M.S.: Finding security vulnerabilities in Java applications with static analysis. In: Proceedings of the 14th USENIX Security Symposium, pp. 271\u2013286 (2005)"},{"key":"11_CR6","doi-asserted-by":"crossref","unstructured":"Jovanovic, N., Kruegel, C., Kirda, E.: Pixy: a static analysis tool for detecting web application vulnerabilities. In: 2006 IEEE Symposium on Security and Privacy, pp. 258\u2013263 (2006)","DOI":"10.1145\/1134744.1134751"},{"key":"11_CR7","series-title":"LNCS","first-page":"124","volume-title":"RAID 2005","author":"T Pietraszek","year":"2006","unstructured":"Pietraszek, T., Berghe, C.V.: Defending against injection attacks through context-sensitive string evaluation. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol. 3858, pp. 124\u2013145. Springer, Heidelberg (2006)"},{"issue":"6","key":"11_CR8","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1145\/1273442.1250739","volume":"42","author":"G Wassermann","year":"2007","unstructured":"Wassermann, G., Su, Z.: Sound and precise analysis of web application for injection vulnerabilities. ACM SIGPLAN Not. 42(6), 32\u201341 (2007)","journal-title":"ACM SIGPLAN Not."},{"issue":"3","key":"11_CR9","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1002\/stvr.450","volume":"21","author":"WGJ Halfond","year":"2011","unstructured":"Halfond, W.G.J., Choudhary, S.R., Orso, A.: Improving penetration testing through static and dynamic analysis. Softw. Test. Verif. Reliab. 21(3), 195\u2013241 (2011)","journal-title":"Softw. Test. Verif. Reliab."},{"key":"11_CR10","doi-asserted-by":"crossref","unstructured":"Bau, J., Bursztein, E., Gupta, D., Mitchell, J.: State of the art: automated black-box web application vulnerability testing, In: 2010 IEEE Symposium on Security and Privacy, pp. 332\u2013345 (2010)","DOI":"10.1109\/SP.2010.27"},{"key":"11_CR11","doi-asserted-by":"crossref","unstructured":"Doup\u00e9, A., Cova, M., Vigna, G.: Why Johnny can\u2019t pentest: an analysis of black-box web vulnerability scanners. In: Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, pp. 111\u2013131 (2010)","DOI":"10.1007\/978-3-642-14215-4_7"},{"key":"11_CR12","doi-asserted-by":"crossref","unstructured":"Khoury, N., Zavarsky, P., Lindskog, D., Ruhl, R.: Testing and assessing web vulnerability scanners for persistent SQL injection attacks. In: Proceedings of the 1st International Workshop on Security and Privacy in e-Societies, pp. 12\u201318 (2011)","DOI":"10.1145\/2107581.2107584"},{"key":"11_CR13","doi-asserted-by":"crossref","unstructured":"Halfond, W.G.J., Orso, A.: AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks. In: 20th IEEE\/ACM International Conference on Automated Software Engineering, pp. 174\u2013183 (2005)","DOI":"10.1145\/1101908.1101935"},{"key":"11_CR14","doi-asserted-by":"crossref","unstructured":"Mohosina, A., Zulkernine, M.: DESERVE: a framework for detecting program security vulnerability exploitations. In: Proceedings of the 2012 IEEE Sixth International Conference on Software Security and Reliability, pp. 98\u2013107 (2012)","DOI":"10.1109\/SERE.2012.22"},{"key":"11_CR15","unstructured":"Anley, C.: Advanced SQL injection in SQL server applications. An NGSSoftware Insight Security Research (2002)"},{"issue":"1","key":"11_CR16","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1145\/77606.77608","volume":"12","author":"S Horwitz","year":"1990","unstructured":"Horwitz, S., Reps, T., Binkley, D.: Interprocedural slicing using dependence graphs. ACM Trans. Program. Lang. Syst. 12(1), 26\u201360 (1990)","journal-title":"ACM Trans. Program. Lang. Syst."},{"key":"11_CR17","doi-asserted-by":"crossref","unstructured":"Tian, W., Yang, J.F., Xu J., Si G.N.: Attack model based penetration test for SQL injection vulnerability. In: Proceedings of the 2012 IEEE 36th IEEE Annual Computer Software and Applications Conference Workshops, pp. 589\u2013594 (2012)","DOI":"10.1109\/COMPSACW.2012.108"},{"key":"11_CR18","doi-asserted-by":"crossref","unstructured":"Wang, J., Phan, R.C.W., Whitley, J.N., Parish, D.J.: Augmented attack tree modeling of SQL injection attacks. In: ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering, pp. 182\u2013186 (2010)","DOI":"10.1109\/ICIME.2010.5478321"},{"key":"11_CR19","unstructured":"IBM Rational AppScan. http:\/\/www-01.ibm.com\/software\/awdtools\/appscan"}],"container-title":["Lecture Notes in Computer Science","Structured Object-Oriented Formal Language and Method"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-04915-1_11","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,2,14]],"date-time":"2023-02-14T11:40:15Z","timestamp":1676374815000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-04915-1_11"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319049144","9783319049151"],"references-count":19,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-04915-1_11","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2014]]},"assertion":[{"value":"21 February 2014","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}