15. The apparatus of claim 11 , further comprising an adding mechanism configured to allow a database administrator to add the signature to the signature cache if the signature generates a mismatch alert and if the query is a valid query.
11. An apparatus for using query signatures to detect SQL injection, comprising: a processor; a memory; an initialization mechanism configured to initialize a signature cache, wherein when initializing the signature cache, the mechanism is configured to: trap database queries in a controlled environment, parse the database queries to produce a set of valid signatures, wherein parsing the database queries involves retaining SQL keywords contained in each query, and removing field names and corresponding values in each query, to determine the signature for each query; wherein the signature for a query contains the text of SQL keywords and operands without any field name or value in the query, store the valid signatures in the signature cache; a receiving mechanism configured to receive a query at the database; a parsing mechanism configured to parse the query at the database to determine a signature for the query, wherein the signature comprises SQL keywords contained in the corresponding query with literals removed; a matching mechanism configured to determine if the signature is located in the signature cache, which contains signatures for valid queries; a processing mechanism configured to process the query if the signature is located in the signature cache; and an alerting mechanism configured to trigger a mismatch alert if the signature is not located in the signature cache.