Structured Query Language Injection Detection Using Natural Language Processing Approaches: A Meta-Analytic Review

Abstract

Structured Query Language Injection (SQLi) attacks remain one of the most persistent threats to web applications, enabling unauthorized access and manipulation of sensitive data. This meta-analysis synthesizes findings from 28 empirical studies (2017–2025) on Natural Language Processing (NLP)-based SQLi detection, following PRISMA 2020 guidelines and PICOS criteria. NLP approaches were compared against non-NLP methods using random-effects meta-analysis, revealing a pooled F1-score advantage of +0.18 (95% CI: 0.14–0.22, p < 0.001). Transformer-based models (e.g., BERT variants) achieved the highest accuracies (up to 99.7%), while deep learning models (CNN-LSTM, Text CNN) offered a practical balance between accuracy and computational efficiency. Beyond performance metrics, this study explicitly maps its methodology to the Research Onion framework, clarifying coherence between philosophy, approach, and methods. Results highlight NLP’s semantic strengths but also expose critical gaps: reliance on outdated datasets, underreporting of computational trade-offs (latency, throughput, and memory), and limited adversarial robustness testing. To bridge laboratory success with production resilience, we propose a hybrid deployment framework: transformer-based models for offline training, lightweight ML or CNN-LSTM for real-time inference, and adaptive retraining pipelines incorporating adversarial examples. This work advances both theory and practice by demonstrating NLP’s superiority in SQLi detection while cautioning against overstated ―near-perfect‖ accuracies in controlled settings. It calls for standardized, real-world datasets, comprehensive benchmarking, and adversarial evaluation protocols to ensure robustness in diverse deployment environments.