As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would it be good idea to use regexp to secured my webapp from sql injection and cross site scripting (xss)and to validate your user input data. So my question is: - should i consider my webapp safe from sql injection, cross-site scripting and some malicious methodology.? - or there othere ways to safe and secured your webapp?

  • 1
    You prevent SQL injection by using parameterized queries. And never rely on client-side validation!! The client is under the control of the attacker, a smart attacker can always find a way around your validation. Jul 7, 2018 at 15:54
  • for a moment let get rid of social engineering attacks. now what would u say? Jul 7, 2018 at 16:11
  • I'm not sure what you mean - social engineering attacks are an entirely different class. The client (web browser) is under the control of the attacker - no social engineering is needed there, all the attacker needs to know is your URL. Jul 7, 2018 at 17:57
  • lets forget about social engineering attacks. i thought u were talking about social engineering. but anyhow how would an attacker manipulate an URL on client side? Jul 7, 2018 at 18:16
  • Ah, that's part of the misunderstanding. They cannot manipulate the URL client-side. But they can manipulate the web page they get. When the web page is received on their end, they can just look at what your JavaScript (or other dynamic content) does. And then they can send back whatever they please. They can avoid client-side validation, because the client (the web browser) is under their control. Jul 7, 2018 at 18:20

1 Answer 1


You shouldn't be relying on regular expressions to prevent SQL injection or XSS

SQL injection is prevented using prepared statements

XSS is prevented using the corresponding encoding for the context where the input value is used, f.e. if you're inside html tags like <p>{{user_input}}</p> it should be encoded using html entities

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .