Abstract: Aiming at the SQL injection attack problem in ASP.NET application, after the analysis on the approach and method of injection attacks, a three-level prevention model is put forward from the aspect of input filtering, statement parameters and SQL keywords escaping. With this model, we can customize the rule of keywords escaping and block the approach of SQL injection attacks effectively. The result of experiments verifies the feasibility and effectiveness of this prevention model.

Key words: SQL filter, model, security, attack
