Web application security problems are as serious as network security problems. Attackers have begun to focus on web application security problems, and are actively developing tools and techniques for detecting and exploiting them. Here is the web application security Prevention Case 1
Validate Input Data
The best way to prevent this is to ensure that all parameters are validated before they are used. A centralized component or library is likely to be the most effective, as the code performing the checking should all be in one place.
Each parameter should be checked against a strict format that specifies exactly what input will be allowed. “Negative” approaches that involve filtering out certain bad input or approaches that rely on signatures are not likely to be effective and may be difficult to maintain.
Parameters should be validated against a “positive” specification that defines:
- Data type (string, integer, real, etc…)
- Allowed character set
- Minimum and maximum length
- Whether null is allowed
- Whether the parameter is required or not
- Whether duplicates are allowed
- Numeric range
- Specific legal values (enumeration)
- Specific patterns (regular expressions)
This includes properly protecting all types of input from the HTTP request, including URLs, forms, cookies, query strings, hidden fields, and parameters.