Deployment-Oriented Multi-Embedding Machine Learning Framework for SQL Injection Detection and Prevention in a Web Application Firewall

Structured Query Language injection (SQLi) remains a persistent threat to web applications due to the obfuscation, diversity, and evolving structure of malicious payloads, which limit the effectiveness of conventional rule and signature-based Web Application Firewalls (WAFs). Although prior studies have reported high detection performance using individual feature extraction methods or offline classification models, limited work has addressed deployment-oriented SQLi prevention through an integrated real-time inspection framework. This paper proposes a Machine Learning (ML)-based SQLi detection and prevention framework that combines hybrid feature representation, supervised dimensionality reduction, Genetic Algorithm (GA)-based hyperparameter optimization, and real-time WAF validation. Multiple public SQLi datasets were merged, cleaned, and deduplicated to improve exposure to diverse query patterns. SQL queries were encoded using Term Frequency–Inverse Document Frequency (TF-IDF), Word2Vec, and FastText features, which were fused and transformed through a Supervised Autoencoder into a compact discriminative representation. GA was then employed to optimize multiple classifiers, including Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), and Multi-Layer Perceptron (MLP). The MLP achieved the best overall performance, with an accuracy of 0.998681. The optimized model was deployed within a lightweight Flask-based WAF for real-time Hypertext Transfer Protocol (HTTP) request inspection and malicious input blocking. SQLMap v1.8.4-based robustness testing and runtime analysis demonstrate that the proposed framework provides effective SQLi prevention with practical deployment efficiency beyond conventional offline benchmark evaluation.