Innocent Code: A Security Wake-up Call for Web Programmers |
Contents
The Basics | 1 |
User Input | 3 |
Passing Data to Subsystems 2222 | 21 |
Copyright | |
12 other sections not shown
Common terms and phrases
able algorithms application asymmetric encryption attacker attacker's authentication bank browser brute-force bugs bytes cache certificate characters clear-text passwords client client-side command contain cookie create Cross-site Scripting cryptographic cryptographic hash function document domain E-mail encoding error message example filtering handle hash function hashed passwords input validation instance Internet IP address Java JavaScript language log-in look message digest metacharacters modify name and password output OWASP packet sniffing parameters pass data password possible POST requests private key problem Protocol proxy public key public key certificates query Referer header Rule secret Section secure code sendmail server-generated input server-side server-side code session hijacking session ID shell single quotes someone SQL Injection subsystem target ticket trick typically Unfortunately Unix user name username victim vulnerable web application web server