Application programs are a possible source of attacks to databases. SQL injection is a well-known attack that exploits the lack of user input sanitization by applications. Following secure code practices to avoid vulnerabilities is the best way to prevent attacks. However, developers usually make mistakes either due to a lack of knowledge (i.e., a beginner developer) or due to bad code practices like copy-paste, which duplicates bugs and vulnerabilities in the code. Detecting such vulnerabilities manually is expensive and time-consuming, especially for very large code bases. Fixing vulnerabilities is also expensive as it requires manual interventions. It is thus clear that in order to systematically find and fix vulnerabilities we need automatic tools. In this paper, we address such a need. We propose theDatabaseClientApplicationsFixer (DCAFixer) tool, which automatically detects and repairs three types of common vulnerabilities in SQL application programs, namely unsanitized user inputs, insecure credentials handling, and unencrypted connections. DCAFixer operates in three phases: fault localization, patch generation and selection, and patch validation.

Application programs are a possible source of attacks to databases as attackers might exploit vulnerabilities in a privileged database application. They can perform code injection or code-reuse attack in order to steal sensitive data. However, as such attacks very often result in changes in the program's behavior, program monitoring techniques represent an effective defense to detect on-going attacks. One such technique is monitoring the library/system calls that the application program issues while running. In this paper, we propose AD-PROM, an Anomaly Detection system that aims at protecting relational database systems against malicious/compromised applications PROgraMs aiming at stealing data. AD-PROM tracks calls executed by application programs on data extracted from a database. The system operates in two phases. The first phase statically and dynamically analyzes the behavior of the application in order to build profiles representing the application's normal behavior. AD-PROM analyzes the control and data flow of the application program (i.e., static analysis), and builds a hidden Markov model trained by the program traces (i.e., dynamic analysis). During the second phase, the program execution is monitored in order to detect anomalies that may represent data leakage attempts. We have implemented AD-PROM and carried experimental activities to assess its performance. The results showed that our system is highly accurate in detecting changes in the application programs' behaviors and has very low false positive rates.