[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-127456-en":3,"doc-seo-127456-105":31,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":28,"seo_description":14,"update_tm":29,"read_time":30},127456,962084925290,"Ophelia","https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45",8,"Research & Report","Machine Learning and Deep Learning Approaches for SQL Injection Detection: A Review","Structured Query Language Injection (SQLi) remains one of the most serious threats to web applications, enabling attackers to bypass signature-based defenses through obfuscation and zero-day payloads. This review examines 50 peer-reviewed studies published between 2015 and 2025, reporting detection accuracies from 93% to 99.9%. It summarizes traditional ML methods and deep learning architectures, along with feature extraction techniques. Evaluation highlights research gaps including limited data availability, class imbalance, real-time deployment challenges, and increased hardware resource demands.","NTU Journal of Engineering and Technology (2025) 4 (4): 1-17  \nDOI: [https://doi.org/10.56286/ntujet.v4i4](https://doi.org/10.56286/ntujet.v4i4)  \nMachine Learning and Deep Learning Approaches for SQL Injection Detection: A Review  \nSahar Saadallah Ahmed1 , Mohand lokman Al dabag2  \n1Department of Computer Engineering Technology, Engineering Technical College, Northern Technical University, Iraq,  \n2Computer Center, Northern Technical University, Iraq.  \n[sahar_saadallah@ntu.edu.iq](sahar_saadallah@ntu.edu.iq), [mohandaldabag@ntu.edu.i](mohandaldabag@ntu.edu.iq)[q](mohandaldabag@ntu.edu.iq)  \nArticle Informations  \nReceived: 27-04-2025, Revised: 21-08-2025, Accepted: 01-09-2025, Published online: 28-12-2025  \nCorresponding author:  \nName:Sahar Saadallah Ahmed  \nAffiliation: Department of Computer Engineering Technology, Engineering Technical College, Northern  \nTechnical University, Iraq Email:  \n[sahar_saadallah@ntu.edu.iq](sahar_saadallah@ntu.edu.iq)  \n[Key Words:](Key Words:)  \nWeb Application Security, SQL Injection (SQLi), Machine Learning (ML), Deep Learning (DL), Natural Language Processing (NLP),  \nA B S T R A C T  \nStructured Query Language Injection (SQLi) remains one of the most serious threats to web applications and has the ability to bypass traditional signature-based detection through obfuscation and zero-day payloads. This has driven the wider application of Machine Learning (ML) and Deep Learning (DL) techniques. This paper analyzes 50 peer-reviewed literatures published in the interval between 2015 and 2025, where the reported accuracy of detection ranged between 93 and 99.9% . Traditional ML methods include Support Vector Machine (SVM), Random Forest (RF), Logistic Regression (LR), and Decision Tree (DT) . DL approaches encompass Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), Bidirectional LSTM (BiLSTM), and transformer-based models such as Bidirectional Encoder Representations from Transformers (BERT) . Feature extraction methods include Term Frequency-Inverse Document Frequency (TF-IDF), Word2Vec, and contextual embeddings. Evaluation of proposed models uncover new research opportunities in terms of lack of data availability, the problem of calss imbalance, real-time application, and excessive use of hardware resources.  \nTHIS IS AN OPEN ACCESS ARTICLE UNDER THE CC BY LICENSE:  \n[https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/)  \n1. Introduction  \nThe fast growth of web-based systems has created major security problems, especially in injection attacks that take advantage of poor input handling. Structured Query Language Injection (SQLi) is one of the most common and harmful of these attacks. By sending specially designed input, an attacker can  \nchange how the database works, causing data leaks or even complete system compromise [1] .  \nFig. 1 shows a standard SQLi example in a web login form. In this case, weak input validation allows a malicious user to change the SQL query and get into the system without permission.  \nFig. 1. SQL Injection Attack Process [1] .  \nThe annual reports of the Open Worldwide Application Security Project (OWASP) Foundation, between 2017 and 2021, ranked SQLi among the top ten most critical web application security risks. During this period, its rank fell from first to third place, despite  \nthat SQLi remained persistently mentioned in cases involving data breaches and infrastructure compromises [2] . Fig. 2 presents the OWASP Top 10 web application security risks, showing the position of SQL injection.  \nFig. 2. OWASP Top 10 risks in 2017 and 2021 [2] .  \nModern, obfuscated, or zero-day SQLi attacks have become increasingly difficult to detect using conventional signature-based or rule-driven defense mechanisms. These techniques rely on pre-established patterns that are inadequate to address new variations or payloads that are behaviorally hidden [3] . Consequently, the researchers became more interested in new an","cbCaiu5lSFHDYBDX","https://ap.wps.com/l/cbCaiu5lSFHDYBDX","pdf",1123031,2,1,18,"English","en",105,"# Introduction\n## SQLi threat and attack process\n## Why signature-based defenses struggle\n## Role of AI, ML, and DL in cybersecurity\n# ML and DL approaches\n## Traditional ML classifiers\n## Deep learning architectures\n## NLP-based text representations\n# Evaluation and research gaps","[{\"question\":\"What makes SQL injection (SQLi) particularly dangerous for web applications?\",\"answer\":\"SQLi can bypass traditional signature-based detection using obfuscation and zero-day payloads, and it enables attackers to manipulate database behavior for data leaks or full system compromise.\"},{\"question\":\"Which machine learning methods are commonly used for SQLi detection?\",\"answer\":\"The review lists Support Vector Machine (SVM), Random Forest (RF), Logistic Regression (LR), and Decision Tree (DT) as traditional ML approaches for classifying malicious inputs.\"},{\"question\":\"What challenges does the review identify after evaluating proposed models?\",\"answer\":\"Key challenges include lack of data availability, class imbalance, difficulties in real-time application, and excessive hardware resource requirements.\"}]","Machine Learning and Deep Learning Approaches for SQL Injection Detection: A Review | PDF",1785938971,45,{"code":4,"msg":32,"data":33},"ok",{"site_id":25,"language":24,"slug":34,"title":13,"keywords":35,"description":14,"schema_data":36,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":29},"machine-learning-and-deep-learning-approaches-for-sql-injection-detection-a-review","",{"@graph":37,"@context":86},[38,54,69],{"@type":39,"itemListElement":40},"BreadcrumbList",[41,45,48,51],{"item":42,"name":43,"@type":44,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":46,"name":47,"@type":44,"position":20},"https://docshare.wps.com/document/","Document",{"item":49,"name":12,"@type":44,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":44,"position":53},"https://docshare.wps.com/document/machine-learning-and-deep-learning-approaches-for-sql-injection-detection-a-review/127456/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":42,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-23","2026-08-05",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What makes SQL injection (SQLi) particularly dangerous for web applications?","Question",{"text":76,"@type":77},"SQLi can bypass traditional signature-based detection using obfuscation and zero-day payloads, and it enables attackers to manipulate database behavior for data leaks or full system compromise.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Which machine learning methods are commonly used for SQLi detection?",{"text":81,"@type":77},"The review lists Support Vector Machine (SVM), Random Forest (RF), Logistic Regression (LR), and Decision Tree (DT) as traditional ML approaches for classifying malicious inputs.",{"name":83,"@type":74,"acceptedAnswer":84},"What challenges does the review identify after evaluating proposed models?",{"text":85,"@type":77},"Key challenges include lack of data availability, class imbalance, difficulties in real-time application, and excessive hardware resource requirements.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":21,"doc_module":4,"doc_module_name":47,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":47,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":47,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":47,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":47,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":47,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":47,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":47,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":47,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":47,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":47,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]