4
votes
3answers
189 views

Name for sanitizing at the right time?

Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ...
0
votes
2answers
197 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
2
votes
3answers
385 views

Validating allowed characters or validating disallowed characters

I've always validated my user input based on a list of valid/allowed characters, rather than a list of invalid/disallowed characters (or simply no validation). It's just a habit I picked up, probably ...
4
votes
2answers
106 views

Would it be hard to screen form submissions (e.g., comments) for non-words/non-sentences?

I've been thinking a lot lately about the need for better form security, and good ways to accomplish that. We currently use captcha codes to screen for bots, but that's annoying to users and may not ...
18
votes
5answers
2k views

Data input validation - Where? How much? [closed]

Data input validation always was quite an internal struggle to me. On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...