All geek questions in one place

Comprehensive server side validation

I currently have a pretty reliable server-side validation system, but I'm looking for some feedback to make sure I cover all corners. Here is a brief description of what I'm doing at the moment:

  • Make sure the input is not empty or too long

  • Escape query strings to prevent SQL injection

  • Using regular expressions to reject invalid characters (it depends on what will be sent)

  • Encoding certain html tags, for example, <script> (all tags are encoded when saved in the database, some of which are decoded when requested to render on the page).

Is there something I am missing? Code samples or regular expressions are welcome.

+3
source share
5 answers

You do not need to use the "Escape" query strings to prevent SQL injection - you should use prepared statements instead.

Ideally, your input filtering will occur before any other processing, so you know that it will always be used. Because otherwise, you only need to skip one place to be vulnerable to the problem.

Remember to encode HTML objects in the output - to prevent XSS attacks.

+8
source

html, "". , , HTML, ( , , "" ..). , , , , htmlentities, , , HTML- ( ) .

+2

, , .

, , .

+1

/ ,
(PHP-, /, php):

PHP?

+1

Filter Extension . , , , , , .

Also, review prepared statements posted. Escaping data in your SQL queries is a thing of the past.

+1
source

Source: https://habr.com/ru/post/1697635/

More articles:


All Articles