  A large number of web applications is based on a relational database together
with a program, typically a script, that enables the user to interact with the
database through embedded SQL queries and commands. In this paper, we introduce
a method for formal automated verification of such systems which connects
database theory to mainstream program analysis. We identify a fragment of SQL
which captures the behavior of the queries in our case studies, is
algorithmically decidable, and facilitates the construction of weakest
preconditions. Thus, we can integrate the analysis of SQL queries into a
program analysis tool chain. To this end, we implement a new decision procedure
for the SQL fragment that we introduce. We demonstrate practical applicability
of our results with three case studies, a web administrator, a simple firewall,
and a conference management system.
