LykanShield protection layer

SQL Injection Filter

Detect encoded SQL payloads while reducing false positives through confidence scoring.

Read integration guide View source on GitHub →

Overview

Pattern matching with structural context

LykanShield collects request input, generates raw, URL-decoded, and double-decoded variants, then compares them with centrally maintained SQL signatures. Candidates are logged, but blocking occurs only when structural SQL indicators reach the configured score.

Request lifecycle

How it works

  1. 01

    Expand input

    Raw and encoded request values are normalized into comparable variants.

  2. 02

    Score matches

    Remote signatures establish a candidate and SQL structure raises confidence.

  3. 03

    Contain attack

    High-confidence matches add the IP locally, report the event, and stop execution.

Implementation

Technical details

  • Inspects encoded and double-encoded payload variants.
  • Logs all candidates to a capped, protected SQL injection log.
  • Uses sql_injection_block_score with a minimum blocking threshold of two.
  • Can send an optional email notification after a blocking detection.

Detection policy

<?php
lykan_config::$config['filter_active']['sql_injection'] = true;
lykan_config::$config['sql_injection_block_score'] = 3;
lykan_config::$config['request_inspection_max_bytes'] = 8192;
lykan_config::$config['email'] = 'security@example.com';
lykan::run(__DIR__);