5.4 Application Security

Input Validation & Sanitization

Applications must check and clean user input before processing it. Input validation ensures data matches expected type, length, and format. Sanitization strips or escapes dangerous characters. Without these controls, attackers can exploit apps with injection attacks like SQL injection or cross-site scripting (XSS), where malicious code is inserted through input fields to manipulate databases or run scripts in a victim's browser.

Common Application Vulnerabilities

SQL injection inserts malicious SQL into queries to access or destroy data. Cross-site scripting (XSS) injects scripts into web pages viewed by other users. Buffer overflow occurs when a program writes more data to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution. Secure coding practices, testing, and validation reduce these risks.

Secure Development Practices

Developers reduce vulnerabilities using secure coding standards, code review, and testing (static/dynamic analysis) before deployment. Patching and updates fix discovered flaws, while least privilege limits what compromised code can access. Building security in from the start—rather than bolting it on later—is the core idea of application security.

Key terms

Input Validation

Checking that user input matches expected type, length, and format before it is processed.

Sanitization

Removing or escaping dangerous characters from input to prevent code execution or injection attacks.

SQL Injection

An attack that inserts malicious SQL code into input fields to manipulate or access a database.

Cross-Site Scripting (XSS)

An attack that injects malicious scripts into web pages viewed by other users, exploiting poor input handling.

Buffer Overflow

A vulnerability where a program writes more data to a buffer than it can hold, potentially overwriting memory and enabling code execution.

Try an AP-style question

Why should security be built in early in development?

1. Early code never has bugs
2. Testers prefer it later
3. Fixing flaws later costs more
4. Security slows users down