The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Handling User Input

Recall the fundamental security problem described in Chapter 1: all user input

is untrusted. A huge variety of different attacks against web applications

involve submitting unexpected input, crafted to cause behavior that was not

intended by the application’s designers. Correspondingly, a key requirement

for an application’s security defenses is that it must handle user input in a safe

manner.

Input-based vulnerabilities can arise anywhere within an application’s func-

tionality, and in relation to practically every type of technology in common use.

“Input validation” is often cited as the necessary defense against these attacks.

However, there is no single protective mechanism that can be employed every-