Protecting Applications
Introduced| English | Meaning |
|---|---|
| secure by design/sɪˈkjʊə baɪ dɪˈzaɪn/ | secure by design |
| secure by default/sɪˈkjʊə baɪ dɪˈfɒlt/ | secure by default |
| input sanitization/ˈɪnpʊt ˌsænɪtaɪˈzeɪʃn/ | Transforming input for a specific purpose or destination; it is not one universal character filter that prevents every injection attack. |
| special characters/ˈspeʃl ˈkærɪktəz/ | Printable punctuation or other non-alphanumeric symbols that may have special meaning in a particular syntax; they are not inherently unsafe data. |
| control characters/kənˈtrəʊl ˈkærɪktəz/ | control characters |
| parameterised queries/ˌpærəˈmetəraɪzd ˈkwɪərɪz/ | Queries that keep their SQL structure separate from data values bound through the database interface. |
Secure by design and default
- Secure by design 安全设计 builds security into every phase of development, including how untrusted data reaches a database, browser or file system.
- Secure by default 默认安全 enables protective settings from the start. It reduces risk; it does not guarantee that a product has no vulnerabilities.
Keep input as data
- Input sanitization 输入清理 transforms input for a specific purpose; validation checks an allowed type, length, range or format. Neither is a universal attack filter.
- Quotes and semicolons are ordinary printable special characters 特殊字符, not necessarily control characters. A legitimate name such as
O'Neillshould not be damaged just because it contains an apostrophe.
Building security into every stage of an application's life cycle
Choose the control for the destination
Separate SQL values from syntax, protect browser output for its context, and restrict resolved file paths; no universal punctuation filter.
"Secure by default" means a product ships with...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Safe defaults enable protections from the start; they do not guarantee a vulnerability-free system.
A numeric SQL field accepts 0 OR 1=1. Which control keeps that input from becoming query syntax?
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The input needs no quotes or semicolon. Parameter binding keeps it as data; validate the numeric range too. HTML encoding serves a different destination.
Keep values separate from SQL syntax by using ____ queries.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Bind each value separately rather than joining it into SQL text.
Which statements use controls suited to the destination? Choose all that apply.
Difficulty 2/5 · 140 coins + a small bonus on first completion today
The first three controls match their destinations. A quote blacklist can damage legitimate names and does not protect all three contexts.
Match the control to the destination
- For SQL injection, use parameterised queries 参数化查询: fixed SQL structure and separately bound data values. Validation adds a check but does not replace binding.
- For XSS, render plain text with a safe text API or apply output encoding for the actual HTML, attribute or other context. If HTML is allowed, use a suitable HTML sanitizer.
- For directory traversal, resolve the requested path and require it to remain inside the permitted directory. Rejecting quote characters does not establish that boundary.
A single character blacklist cannot protect every destination. An age field can be abused with 0 OR 1=1, which needs no quotes or semicolon. The right defense keeps input out of the query's syntax. Validation must also check whether the age is a valid number in the allowed range.
Secure by design means adding security features after the product is finished.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
False. Secure by design builds security in from the earliest phase of development, rather than bolting it on afterwards.
A pupil search should accept the exact name O'Neill. Write a fixed query such as SELECT name FROM pupils WHERE name = ? and bind the entered name separately. An input such as ' OR '1'='1 then remains one name value rather than changing the query. When displaying a name, insert it as text; do not assemble executable HTML from it. This preserves legitimate input while protecting both destinations with their own controls.
Build security into the design and enable safe defaults. Validate input for the task, keep SQL values separate from SQL syntax, encode or safely render browser output, and enforce file-system boundaries. Do not claim that stripping punctuation stops every input attack.