0

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would it be good idea to use regexp to secured my webapp from sql injection and cross site scripting (xss)and to validate your user input data. So my question is: - should i consider my webapp safe from sql injection, cross-site scripting and some malicious methodology.? - or there othere ways to safe and secured your webapp?

  • 1
    You prevent SQL injection by using parameterized queries. And never rely on client-side validation!! The client is under the control of the attacker, a smart attacker can always find a way around your validation. – S.L. Barth Jul 7 '18 at 15:54
  • for a moment let get rid of social engineering attacks. now what would u say? – stackOverFlowGeek Jul 7 '18 at 16:11
  • I'm not sure what you mean - social engineering attacks are an entirely different class. The client (web browser) is under the control of the attacker - no social engineering is needed there, all the attacker needs to know is your URL. – S.L. Barth Jul 7 '18 at 17:57
  • lets forget about social engineering attacks. i thought u were talking about social engineering. but anyhow how would an attacker manipulate an URL on client side? – stackOverFlowGeek Jul 7 '18 at 18:16
  • Ah, that's part of the misunderstanding. They cannot manipulate the URL client-side. But they can manipulate the web page they get. When the web page is received on their end, they can just look at what your JavaScript (or other dynamic content) does. And then they can send back whatever they please. They can avoid client-side validation, because the client (the web browser) is under their control. – S.L. Barth Jul 7 '18 at 18:20
1

You shouldn't be relying on regular expressions to prevent SQL injection or XSS

SQL injection is prevented using prepared statements

XSS is prevented using the corresponding encoding for the context where the input value is used, f.e. if you're inside html tags like <p>{{user_input}}</p> it should be encoded using html entities

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.