Stefan Esser presents an approach, a way to detect unknown query types which are result of SQL-Injection. The said approach is a simple way to make arbitrary applications more secure without touching a single line of code.
This approach is based on the idea that SQL queries issued by an application always have a certain structure. This structure can be learned and remembered by MySQL-Proxy. Any SQL query that has a different structure can then be considered an attack.
