We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible solution I've been working on for this. The only thing I lack is possibilities and opinions for this idea.
Based off of the Web Application Firewall, I planned on creating a vBulletin plugin (first) in order to detect unsanatized code by including functions for all possible unsanatized code and sandbox it. In order to lower privileges of anyone without a key (either user defined or generated), either the forum owner will manually access the control panel and disallow what code gets filtered/blocked or automatically detect what known vulnerabilities the code may have and give a 404 to any user that inputs arbitrary exploitable code such as SQLi (accessing a table other than the one on the page allows) and others.
Since people have told me that using a Web Application Firewall has many bypasses that are just annoying to the hacker, I was wondering whether or not sandboxing and lowering privileges is a good idea if I improve the functionality on vBulletin through numerous plugins/products so it can be at least 90% versatile over time?
Opinions are welcome as well. Another question is known bad coding practices. I don't know everything, but I know my mistakes and people have broken and hacked their way through my code to show me. What bad coding practices are known and uncommon/known and common in PHP/JS?
Thanks for the time. If this would fit in another SE site, sorry & many thanks if it gets migrated.
I was wondering whether or not protecting the additions to a site before protecting the site overall is a good idea. If we look at vBulletin as it stands right now, people are still creating plugins and products that aren't 100% secured and lead to finding that there may be unnecessary code, improper sanitation, and/or unsanatized input. This would wrap the code and protect it through privilege restrictions. The cons about this is less knowledge about security to the owner(s), but more time knowing your website is protected whether you're vulnerable or not.