Idea: Using System Level Testing for Revealing SQL Injection-Related Error Message Information Leaks

Completely handling SQL injection consists of two activities: properly protecting the system from malicious input, and preventing any resultant error messages caused by SQL injection from revealing sensitive information. The goal of this research is to assess the relative effectiveness of unit and system level testing of web applications to reveal both error message information leak and SQL injection vulnerabilities. To produce 100% test coverage of 176 SQL statements in four open source web applications, the author augmented the original automated unit test cases with our own system level tests that use both normal input and 132 forms of malicious input. Although the authors' discovered no SQL injection vulnerabilities, they exposed 17 error message information leak vulnerabilities associated with SQL statements using system level testing.