You are presented with multiple paper abstracts, alongside the associated literature review and chapter titles. Given the provided information, you are going to do a literature review. Please generate a coherent literature review that synthesizes the content, draws connections between different works, highlights major findings, and identifies any gaps in the existing research.

Literature Review Title: A Survey Of Sql Injection Countermeasures 
Chapter Title:  Static Analysis Approach 
1. Abstract of Cited Paper (BIB001):  Vulnerabilities in web applications allow malicious users to obtain unrestricted access to private and confidential information. SQL injection attacks rank at the top of the list of threats directed at any database-driven application written for the Web. An attacker can take advantages of web application programming security flaws and pass unexpected malicious SQL statements through a web application for execution by the back-end database. This paper proposes a novel specification-based methodology for the detection of exploitations of SQL injection vulnerabilities. The new approach on the one hand utilizes specifications that define the intended syntactic structure of SQL queries that are produced and executed by the web application and on the other hand monitors the application for executing queries that are in violation of the specification. The three most important advantages of the new approach against existing analogous mechanisms are that, first, it prevents all forms of SQL injection attacks; second, its effectiveness is independent of any particular target system, application environment, or DBMS; and, third, there is no need to modify the source code of existing web applications to apply the new protection scheme to them. We developed a prototype SQL injection detection system (SQL-IDS) that implements the proposed algorithm. The system monitors Java-based applications and detects SQL injection attacks in real time. We report some preliminary experimental results over several SQL injection attacks that show that the proposed query-specific detection allows the system to perform focused analysis at negligible computational overhead without producing false positives or false negatives. Therefore, the new approach is very efficient in practice.

Literature Review:
Static analysis can help programmers detect vulnerabilities they have overlooked and optimize codes. Although it is best used in the application development and debugging phase, it can also be used for protecting existing applications and programs. Developers can use static analysis to find bugs in programs so that they can modify source code or make patches for the applications. However, it could be tedious and time-consuming to patch a deployed system. In addition, static analysis often fails to detect all kinds of vulnerabilities so that it is easy to get high false negative rate BIB002 . What's more, static analysis can only identify the information available at compile time. In some cases, static analysis cannot capture the exact structure of an intended query because the full structure is only known at runtime BIB001 . For example, a web application ofa bookstore allows users to search books and can display the result in the order that is specified by users. The search result can be sorted by any of the columns such as the author's name and publication date by using an ORDER BY clause in the query. At compile time, it is impossible to know if or not the clause will be present in the query, because if a user does not want a sorted result he may just ignore the "Order by" options on the webpage. If the ORDER BY clause is used, it is still impossible to know the exact query statement at compile time because what column users will choose to sort results remains unknown until the runtime.