Browse DevX
Sign up for e-mail newsletters from DevX


Five Tips for Thwarting Data Input Attacks Against Your Web App  : Page 4

The Web is a battleground where data input attacks are a real danger. Michael Howard illustrates how attackers can gain access to your Web apps and how best to stop them.




Building the Right Environment to Support AI, Machine Learning and Deep Learning

Tip 3—Beware of Quotes
Quotes can be difficult to handle because they can fool SQL strings. As I showed earlier, an attack can use quotes to create different SQL query logic and allow anyone to logon without a valid username and password. Another way to help mitigate quoting attacks is to escape the quote characters first. The following regular expression will double up all single and double quotes. This is perfectly valid SQL syntax, which can help make many attacks harder to execute:

strPwd = strPwd.replace(/([\'\"])/g,"$1$1");

You could use this in place of the regular expression just added. Personally, I use both—defense in depth!

Comment and Contribute






(Maximum characters: 1200). You have 1200 characters left.



Thanks for your registration, follow us on our social networks to keep up-to-date