Tag Info

New answers tagged


The two main risks of a system such as this are: SQL Injection XSS The risk of SQL Injection is mitigated by the use of parameterised queries. This ensures that data values inserted into the database can only be interpreted as data and not by part of the query by an attacker escaping out of the context. XSS is prevented by correct output escaping. This ...


Set <form> accept-charset Attribute using UTF-8 Sanitize all the html / xml special characters and replace them with their escaped version. Display the code within the <pre> tags


You escape the output by replacing "special" characters with their HTML character entities. In PHP, you can do this using htmlspecialchars(), for example. I suggest using the ENT_QUOTES flag to ensure all types of quotes get encoded.


Could there be some miscommunication between you and the IT department head? As Xander had already pointed out, such a scheme does not work, and I would even add that it is ridiculous. In order to authenticate a user, a database lookup has to be performed on the login email address in order to retrieve the corresponding hash used for comparison: SELECT hash ...


As far as I can tell, this scheme doesn't make any sense. As you've noted, you still need to store the plaintext email address for the user, so there isn't any significant security benefit to using the plaintext email and email + password + salt hash vs just using plaintext email and password + salt hash. As I'm sure you've already noted, without the ...


Sorry, I do not get the part on your concern with timing attacks. As long as the passwords are properly hashed and the comparison is done on the hashes, your application should be safe from this kind of side channel attack. Whether a database call has been made or not (2s vs 1s) does not leak any information on your password. It is always good to validate ...


Validating the format of email address or password field for being empty can be done on client side and does not result in timing attack, because there is no comparison being done with the actual hash of the password(or password) which is stored on the server side. The timing attack occurs if the comparison operation is not implemented properly. Let us ...

Top 50 recent answers are included