SQL injection attacks remain a pervasive threat to the security of web applications, especially those backed by relational databases such as PostgreSQL and Oracle. Traditional defensive techniques – from static code analysis to runtime firewalls – often rely on rule-based heuristics and secure coding practices (e.g. using prepared statements) that struggle to keep pace with evolving attack patterns. Recent research has turned to artificial intelligence (AI) and machine learning (ML) to detect and prevent SQL injection dynamically, learning malicious query patterns from data rather than static rules. This paper surveys modern scientific literature (with an emphasis on IEEE and ACM sources) on protecting relational databases from SQL injection, focusing on applied methods implemented in Java environments for PostgreSQL and Oracle databases. We review state-of-the-art solutions, including static analysis tools, runtime monitoring systems, and novel AI/ML-driven detectors. We highlight cutting-edge approaches such as deep learning models (e.g. CNNs, LSTMs, transformers) that automatically learn query features, and discuss how these can be integrated into Java applications. We analyze system architectures and algorithms from recent studies, and illustrate practical implementations with code examples and system diagrams. Building on these insights, we propose an original approach – a graph-based ML detection system integrated at the JDBC driver level – that leverages the structural patterns of SQL queries and adaptive learning to thwart injection attempts in real-time. This proposed method aims to advance the state of the art by combining parse-tree analysis with deep neural networks, offering both scientific novelty and practical significance. The paper follows the IMRaD structure (Introduction, Methods, Results, Discussion), and includes an evaluation plan using real-world attack data on PostgreSQL and Oracle. Our work not only demonstrates the promise of AI-driven SQL injection defenses but also provides a blueprint for deploying these techniques in enterprise Java applications.
Choriyev et al. (Sun,) studied this question.