Common web attacks

1. SQL injection:
In an SQL statement, if there is a '--' character, the SQL statement is executed with a comment--the contents after the character. A program that has a SQL injection vulnerability is a program that accepts parameters passed from a variable or URL that is entered by a client user, and that the variable or parameter is part of a SQL statement.
Harm:
1. Illegally reading, tampering, and deleting data
2. Stealing all kinds of sensitive information from users to gain benefits
3. Modify the content on the page by modifying the database
4. Trojan Horse and so on

Prevention methods are:
1. SQL statements that use precompiled binding variables, such as execute ()
2. Strictly encrypt and process the user's confidential information
3. Do not open the Webserver error display in the production environment arbitrarily
4. Using regular expressions to filter incoming parameters
5. String filtering
6. Check if the letter is not an illegal character

2. XSS attack: XSS cross-site Scripting Attack (crosses site Scripting)
Harm:
1. Stealing all kinds of user accounts, such as user Network Bank account, all kinds of administrator account
2. Stealing important business-value information
3. Illegal transfer
4. Control the victim machine to launch attacks on other websites, inject Trojan horses, etc.

Process:
The victim sends a URL request to the server, and the server returns the data
Hackers found a vulnerability in the server

Prevention:
1. The code to the user input places and variables need to carefully check the length and the ' < ', ' > ', '; ', ' ' "and other characters do filter
2. Avoid disclosing user privacy directly in a cookie, such as email, password, etc., by using cookies and system IP bindings to reduce the risk of cookie leaks
3. Use post rather than get submit form

3. CSRF (Cross-site request forgery) cross-site requests forgery, also known as "one click Attack" or Session Riding, usually abbreviated as CSRF or XSRF, is a malicious use of the site. Although it sounds like cross-site scripting (XSS), it is very different from XSS, where XSS leverages trusted users within the site, while CSRF leverages trusted sites by disguising requests from trusted users. Compared to XSS attacks, csrf attacks are often less prevalent (and therefore have very few resources to protect against them) and are difficult to guard against, so they are considered more dangerous than XSS.

Send a random string, check it,

CSRF put it in Process_view inside.
@csrf_exempt (Exemption from certification)
@csrf_protect (requires authentication)

Harm:
1. Send mail in your name
2. Steal your Account
3. Purchase of goods
4. Virtual Currency transfer

Principle:

Common web attacks