Abstract: A method for protecting database applications including analyzing the activity on the server, analyzing the response from the server, and blocking malicious or unauthorized activity. Commands are analyzed for suspicious or malicious SQL statements or access to unauthorized data. Server responses are monitored for suspicious results likely to have occurred from a successful attack or unauthorized access to data. When malicious or unauthorized activity occurs, activity by the source is blocked or an alert is issued.