5 ms·
The biggest security hole is user input. Just escape every input: For sql, to avoid sql injection: https://datacadamia.com/data/type/relation/sql/parameter htt
by gerardnico 2y ago
The biggest security hole is user input.
Just escape every input:
For sql, to avoid sql injection:
https://datacadamia.com/data/type/relation/sql/parameter https://datacadamia.com/data/type/relation/sql/parameter
For html, if somebody try to inject html:
https://datacadamia.com/web/html/entity https://datacadamia.com/web/html/entity
You got 99% of security holes patched.
All the best
- r0s 2y agoThis is on point. One other thing is to limit input frequency, only allow a certain amount of posts over some period of time. Enforce this on both the front and back-end. A little more complex, you can set a lifetime limit per user by IP address, which won't stop a truly dedicated attacker but will definitely block most of the random web crawler scripts that find your site.
- IggleSniggle 2y agoIP limiting is not so simple anymore if you want to anticipate much traffic, since services like iCloud Private Relay or Cloudflare WARP forward requests through single regional IPs. You can still do some limiting, you just might bounce some of your legitimate visitors. But for that reason alone lifetime limiting seems like a bad idea to me.
- awinter-py 2y agodelete 99% of users, patch 99% of security holes
- razodactyl 2y agoI feel I'm not supposed to upvote this as much as I have...
- devwastaken 2y agoSpecifically if using SQL then use prepared statements or equivalent and ensure that the SQL user account uses for queries is restricted to doing just that.