Skip to main content
Top

2018 | OriginalPaper | Chapter

MySQL Extension Automatic Porting to PDO for PHP Migration and Security Improvement

Authors : Fabio Mondin, Agostino Cortesi

Published in: Computer Information Systems and Industrial Management

Publisher: Springer International Publishing

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

In software management, the upgrade of programming languages may introduce critical issues. This is the case of PHP, the fifth version of which is going towards the end of the support. The new release improves on different aspects, but removes the old deprecated MySQL extensions, and supports only the newer library of functions for the connection to the databases. The software systems already in place need to be renewed to be compliant with respect to the new language version. The conversion of the source code, to be safe against injection attacks, should involve also the transformation of the query code. The purpose of this work is the design of specific tool that automatically applies the required transformation yielding to a precise and efficient conversion procedure. The tool has been applied to different projects to provide evidence of its effectiveness.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literature
1.
go back to reference Artzi, S., et al.: Finding bugs in web applications using dynamic test generation and explicit-state model checking. IEEE Trans. Softw. Eng. 36(4), 474–494 (2010)CrossRef Artzi, S., et al.: Finding bugs in web applications using dynamic test generation and explicit-state model checking. IEEE Trans. Softw. Eng. 36(4), 474–494 (2010)CrossRef
2.
go back to reference Clause, J.A., Li, W., Orso, A.: Dytan: a generic dynamic taint analysis framework. In: ISSTA 2007, pp. 196–206 (2007) Clause, J.A., Li, W., Orso, A.: Dytan: a generic dynamic taint analysis framework. In: ISSTA 2007, pp. 196–206 (2007)
4.
go back to reference Hauzar, D., Kofron, J.: Framework for static analysis of PHP applications. In: ECOOP 2015, pp. 689–711 (2015) Hauzar, D., Kofron, J.: Framework for static analysis of PHP applications. In: ECOOP 2015, pp. 689–711 (2015)
5.
go back to reference Khmelevsky, Y., Rinard, M., Sidiroglou-Douskos, S.: A source-to-source transformation tool for error fixing (2013) Khmelevsky, Y., Rinard, M., Sidiroglou-Douskos, S.: A source-to-source transformation tool for error fixing (2013)
6.
go back to reference Kiezun, A., Guo, P.J., Jayaraman, K., Ernst, M.D.: Automatic creation of SQL injection and cross-site scripting attacks. In: ICSE 2009, pp. 199–209 (2009) Kiezun, A., Guo, P.J., Jayaraman, K., Ernst, M.D.: Automatic creation of SQL injection and cross-site scripting attacks. In: ICSE 2009, pp. 199–209 (2009)
8.
go back to reference Pawlak, R., Monperrus, M., Petitprez, N., Noguera, C., Seinturier, L.: SPOON: a library for implementing analyses and transformations of Java source code. Softw. Pract. Experience 46, 1155–1179 (2015)CrossRef Pawlak, R., Monperrus, M., Petitprez, N., Noguera, C., Seinturier, L.: SPOON: a library for implementing analyses and transformations of Java source code. Softw. Pract. Experience 46, 1155–1179 (2015)CrossRef
10.
go back to reference Wassermann, G., Su, Z.: Sound and precise analysis of web applications for injection vulnerabilities. PLDI 46, 32–41 (2007) Wassermann, G., Su, Z.: Sound and precise analysis of web applications for injection vulnerabilities. PLDI 46, 32–41 (2007)
11.
go back to reference Zanioli, M., Ferrara, P., Cortesi, A.: SAILS: static analysis of information leakage with sample. In: ACM SAC 2012, pp. 1308–1313 (2012) Zanioli, M., Ferrara, P., Cortesi, A.: SAILS: static analysis of information leakage with sample. In: ACM SAC 2012, pp. 1308–1313 (2012)
Metadata
Title
MySQL Extension Automatic Porting to PDO for PHP Migration and Security Improvement
Authors
Fabio Mondin
Agostino Cortesi
Copyright Year
2018
DOI
https://doi.org/10.1007/978-3-319-99954-8_38

Premium Partner