Testing is essential for quality assurance of database applications. Achieving high code coverage of the database application is important in testing. In practice, there may exist a copy of live databases that can be used for database application testing.

Using an existing database state is desirable since it tends to be representative of real-world objects' characteristics, helping detect faults that could cause failures in real-world settings. However, to cover a speci¯c program code portion (e.g., block), appropriate program inputs also need to be generated for the given existing database state. To address this issue, we develop a novel approach that generates program

inputs for achieving high code coverage of a database application, given an existing database state. Our approach uses symbolic execution to track how program inputs are transformed before appearing in the executed SQL queries and how the constraints on query results a®ect the application's execution. One signi¯cant challenge in our problem context is the gap between program-input constraints derived from the pro-

gram and from the given existing database state; satisfying both types of constraints is needed to cover a speci¯c program code portion.