How to ensure website security checks

Question

Hi;

How to safe gaurd a form against script injection attacks. This is one of the most used form of attacks in which attacker attempts to inject a JS script through form field. The validation for this case must check for special characters in the form fields. Look for suggestions, recommedations at internet/jquery etc for permissible characters & character masking validation JS codes.

Answer 1

You can use the HTML Purifier (in case you are under PHP or you might have other options for the language you are under) to avoid XSS (cross-site-scripting) attacks to great level but remember no solution is perfect or 100% reliable. This should help you and always remember server-side validation is always best rather than relying on javascript which bad guys can bypass easily disabling javascript.

For SQL Injection, you need to escape invalid characters from queries that can be used to manipulate or inject your queries and use type-casting for all your values that you want to insert into the database.

See the Security Guide for more security risks and how to avoid them. Note that even if you are not using PHP, the basic ideas for the security are same and this should get you in a better position about security considerations.

Answer 2

ASP.NET has a feature called Request Validation that will prevent unencoded HTML from being processed by the server. For extra protection, one can use the AntiXSS library.

Answer 3

you can prevent script injection by encoding html content like

Server.HtmlEncode(input)

Answer 4

There is the OWASP EASPI too.

Answer 5

Probably the best reference for this is at the OWASP XSS Prevention Cheat Sheet