Product · Database protection
A second line of defence where your data lives.
Request rules judge what arrives at your site. The DBshieldX query check watches what reaches your database, and flags any query your app has never sent before.
The DB in DBshieldX
Your queries have shapes.
Your app sends the same few shapes of query thousands of times a day. DBshieldX learns those shapes with the values removed. An injection changes the shape, so a query it has never seen stands out, even when the request looked harmless at the front door.
That matters because a request rule has to guess, from the outside, whether a value will change a query. The query check doesn't guess: it sees the query your app actually sent.
Illustration; the injected clause is elided.
How it works
01 · Learn
From normal use
DBshieldX learns each app's query shapes from its everyday traffic. Every app gets its own list.
02 · Compare
Every new query
Each query is reduced to its shape, with values removed, and compared with what the app normally sends.
03 · Weigh
What the change does
New shapes with stacked queries, delays or system-catalog reads get extra weight, because normal application code rarely produces them.
04 · Flag
With the reason attached
A known shape scores nothing. An unseen shape is flagged, and each check it trips is named, so you can see why it stood out.
Good to know
Never stores your values
Only the shape of a query is kept. The names, emails and numbers in it are removed before anything is recorded.
Attacks aren't learned as normal
While it is still learning, a query that trips a strong check is refused rather than learned, so an attack during the learning period doesn't become part of "normal".
Live or from a log
It works from live statements or from a recorded PostgreSQL session log.
Behind the request check
The request check stops most attacks before they reach your code. The query check catches what changed a query anyway.
Not a code fix
Parameterised queries in your code remain the fix for SQL injection. The query check tells you when something got through.
New releases, new shapes
A new feature brings new queries. Expect to review a few new shapes after a release; most will be your own code.
In the Business plan
The SQL query check is part of the Business and Agency plans. See pricing.
See it on your own traffic.
We'll set up DBshieldX in monitor mode on one of your sites and walk you through what it finds after a week. Nothing is blocked until you say so.