期刊名称：Journal of Theoretical and Applied Electronic Commerce Research
印刷版ISSN：0718-1876
电子版ISSN：0718-1876
出版年度：2010
卷号：5
期号：1
页码：39-55
语种：English
出版社：Universidad de Talca
其他摘要：An Input validation can be a critical issue. Typically, a little attention is paid to it in a web development project, because overenthusiastic validation can tend to cause failures in the software, and can also break the security upon web applications such as an unauthorized access to data. Now, it is estimated the web application vulnerabilities (such as XSS or SQL injection) for more than two thirds of the reported web security vulnerabilities. In this paper, we start with a case study of the bypassing data validation and security vulnerabilities such as SQL injection and then go on to discuss the merits of a number of common data validation techniques. We also review the different solutions to date to provide data validation techniques in ecommerce applications. From this analysis, a new data validation service which is based upon semantic web Technologies, has been designed and implemented to prevent the web security vulnerabilities at the application level and to secure the web system even if the input validation modules are bypassed. Our semantic architecture consists of the following components: RDFa annotation for elements of web pages, interceptor, RDF extractor, RDF parser, and data validator. The experimental results of the pilot study indicate that the proposed data validation service might provide a detection, and prevention of some web application attacks.
关键词：Web Application; Data Validation; Vulnerabilities; e-Commerce; SQL injection; Web system; On the fly; Data Tampering
