Уязвимости приложений и данных, атаки на них

Bad input is the danger

• When a program does not check input, an adversary slips in commands — an injection attack 注入攻击.
• Data validation 数据验证 (checking input meets rules) is the defense.
• Unencrypted files and over-broad admin rights add more risk.

SQL injection and XSS

• SQL injection SQL注入: SQL commands in an input field read or change a database.
• Cross-site scripting (XSS) 跨站脚本: injected script runs in another user's browser.
• Both come from trusting unchecked user input.

SQL injection: input pasted into a query changes the query itself