Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid email id". Code is like,

if(EmailIdIsNull)
{
   error = "Please enter valid email id";
   //Submit this error message to the form
}

This way of handling the check is vulnerable to hazardous character injection. For eg., one changed "Please enter valid email id" to "%22@27%3ECIMG+SRC%3D.html%22%3E"

Solution for this was given as,

"If available, use structured mechanisms that automatically enforce the separation 
between data and code. These mechanisms may be able to provide the relevant quoting,
encoding and validation automatically, instead of relying on the developer to provide
this capability at every point where output is generated"

Am looking for an explanation of the above solution. Also, how can one apply above solution in my case regarding client side check of email id?

share|improve this question

closed as unclear what you're asking by Adnan, NULLZ, AJ Henderson, Terry Chia, Eric G Aug 11 '13 at 18:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Maybe it's just me, but I have no clue what you're asking. –  Adnan Aug 9 '13 at 9:41
    
@Svetlana Am looking for an explanation for, "If available, use structured mechanisms that automatically enforce the separation ......" Which I have mentioned in my question.. –  Vikas V Aug 9 '13 at 9:47
    
Possible source of the quote: cwe.mitre.org/data/definitions/116.html (@Svetlana) –  Perseids Aug 9 '13 at 9:58
1  
Can you please explain why you believe your code is vulnerable to an injection attack? As far as I see there is no user data injected anywhere. –  Perseids Aug 9 '13 at 10:03
    
I think your doubt should be explained better. What is the problem with that sentence? –  kinunt Aug 9 '13 at 10:04

2 Answers 2

First of all, you should never rely on client-side code for any sort of validation whatsoever. It is laughably trivial to bypass any validation on the client-side.

Instead, you should always sanitize and escape any inputs on the server side. Sure, you can perform client-side validation to ensure a good user experience, but always validate on your server as well.

I presume that email address will be written to a database somewhere. In that case, use parameterized queries instead of dynamic SQL. That will protect you from SQL injection attacks. You should escape the data when outputting it to prevent XSS attacks. The XSS and SQL injection prevention cheatsheets from OWASP is a helpful reference here.

share|improve this answer
    
can you kindly edit your answer and provide explanation for "If available, use structured mechanisms that automatically enforce the separation ......." which I have mentioned in my question.. –  Vikas V Aug 9 '13 at 9:48
1  
@VikasV Parameterized queries IS enforcing the separation of code from data. I suggest you read the links in my answer. –  Terry Chia Aug 9 '13 at 9:49
    
-1 Although the question itself is badly written and doesn't describe the problem well enough, your answer has nothing to do with the question. Also, that's not what separation of code from data means. –  Adnan Aug 9 '13 at 9:53

Parametrized queries or prepared statements are an example of "mechanisms that automatically enforce the separation between data and code".

The problem when there are no separation between data and code is that data introduced by a user can be injected in code and can manipulate the application in ways not thought by the programmer.

For other mechanisms that "provide the relevant quoting, encoding and validation automatically" you can search information about OWASP ESAPI or Java Spring Security Framework.

The recomendation of not "relying on the developer to provide this capability at every point where output is generate" is because if you rely in a human probably you will have errors. If you use a centralized API that makes impossible to programmers to miss a input validation, you will be safer.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.