Database protection method and system based on SQL signature

The invention discloses a database protection method and system based on an SQL signature, and the method comprises the steps: S1, building a database security proxy gateway between an application service and a database service, receiving a database access request from an application through the database security proxy gateway, and extracting an SQL statement; s2, analyzing the extracted SQL statements, constructing an AST syntax tree of the SQL statements, explaining semantic features, extracting SQL fingerprints to generate SQL signatures, and constructing a legal signature library; and S3, comparing the SQL signatures of the database access requests by using the constructed signature library, and blocking illegal requests which are not in the legal signature library. A defense strategy is implemented in a white list mode, on one hand, the problem that attack injection is carried out by changing a grammar structure through vulnerabilities is eliminated, and normal access behaviors of application services ar