Tag Info

New answers tagged

1

This example doesn't prevent against changing the value intentionally because the explained functionality says that the user is allowed to set the payeeLstId parameter. However, the example provided does prevent against multiple attacks because the parameter is first cast to an int before being used to query for the account. By tampering I'm assuming OWASP ...


4

This answer will depend on which PKI software you're using and how it's configured to handle revocation information. Certificate errors have a precedence; you want to check the most severe first. The general procedure for validating a certificate is: Check that the Root Cert is in your trust store (or some complicated path-building for a big corporate CA, ...


3

I would recomend validating the imput and sanitizing the output. That way you can ensure that valid data are being stored on the database and harmless data is consumed on the users' end. If a field expects a date, make sure you are receiving a date. You can easily validate dates, numbers, emails, ZIP codes, phone numbers, and a lot of fields. So do it. Do ...


7

Gee... "Sanitize output." I've never actually heard that term used before. I've been doing this for, oh, I don't know. Over a decade now at least. You don't "sanitize your output" you encode it for proper context within the application it is being presented. You encode the output for HTML, HTML Attribute, URL, JavaScript... I've never seen or heard anyone ...


3

You don't know how to sanitise data until you output it, or more precisely use it. In many cases it might seem obvious; in your blogging engine you want to filter out script-tags; always and ever so you simply delete them from the input and never think of them again. In other cases it might not be so easy; if the same data is used in different contexts. ...


2

It is a risk to have XSS content in your database. Databases are meant to be shared by applications, and are long-lived compared to web front-ends. Example: The new intern starts working on a new web app for the db, shows his boss, and bam, his login cookie is in St. Petersburg. You don't want to alter user input, you want to validate user input and reject ...


22

When you sanitize input, you risk altering the data in ways that might make it unusable. So input sanitization is avoided in cases where the nature of the data is unknown. For instance, perhaps some special characters hold significance in the data and stripping them means destroying that significance. A scenario like this may be that your system stores ...



Top 50 recent answers are included