In this paper, a new type of SQL Injection attack through HTTP Headers is studied. Through analysising an example of the SQL Injection attack, the principle of the new type of SQL Injection attack is revealed, and the defense for the new type of SQL Injection attack is proposed. A defense model is established via such means as the IP filtering, data validation and machine learning, and this model has such advantages as low invasive, easy realization, high availability and strong expandability.