The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Safe Data Handling

Very many web application vulnerabilities arise because user-supplied data is

processed in unsafe ways. It is often the case that vulnerabilities can be

avoided, not by validating the input itself but by ensuring that the processing

that is performed on it is inherently safe. In some situations, there are safe pro-

gramming methods available that avoid common problems. For example, SQL

injection attacks can be prevented through the correct use of parameterized

queries for database access (see Chapter 9). In other situations, application

functionality can be designed in such a way that inherently unsafe practices,