As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would it be good idea to use regexp to secured my webapp from sql injection and cross site scripting (xss)and to validate your user input data. So my question is: - should i consider my webapp safe from sql injection, cross-site scripting and some malicious methodology.? - or there othere ways to safe and secured your webapp?
5
-
1You prevent SQL injection by using parameterized queries. And never rely on client-side validation!! The client is under the control of the attacker, a smart attacker can always find a way around your validation.– S.L. Barth is on codidact.comJul 7, 2018 at 15:54
-
for a moment let get rid of social engineering attacks. now what would u say?– stackOverFlowGeekJul 7, 2018 at 16:11
-
I'm not sure what you mean - social engineering attacks are an entirely different class. The client (web browser) is under the control of the attacker - no social engineering is needed there, all the attacker needs to know is your URL.– S.L. Barth is on codidact.comJul 7, 2018 at 17:57
-
lets forget about social engineering attacks. i thought u were talking about social engineering. but anyhow how would an attacker manipulate an URL on client side?– stackOverFlowGeekJul 7, 2018 at 18:16
-
Ah, that's part of the misunderstanding. They cannot manipulate the URL client-side. But they can manipulate the web page they get. When the web page is received on their end, they can just look at what your JavaScript (or other dynamic content) does. And then they can send back whatever they please. They can avoid client-side validation, because the client (the web browser) is under their control.– S.L. Barth is on codidact.comJul 7, 2018 at 18:20
Add a comment
|
1 Answer
You shouldn't be relying on regular expressions to prevent SQL injection or XSS
SQL injection is prevented using prepared statements
XSS is prevented using the corresponding encoding for the context where the input value is used, f.e. if you're inside html tags like <p>{{user_input}}</p> it should be encoded using html entities
