A typical Denial of Service attack against a DBMS may occur through a query flood, that is, a large number of queries and/or updates sent by a malicious subject or several colluding malicious subjects to a target database with the intention to hinder other subjects from being serviced. In this paper we present experimental results showing that such attacks indeed degrade the performance of the DBMS; our experiments are conducted on several well known DBMS. We then propose some simple yet effective techniques for detecting query-flood attacks and protecting a DBMS against them.