The check item marked with (*) indicates that this item is a fundamental solution to the problem and should be done with the best effort to complete the content. If the project is not marked (*), it indicates that this item cannot completely eliminate security risks, but this method can be used to avoid security problems. The last one does not seem to be interesting.
1. SQL Injection
1. (*) use the SQL variable binding function when combining SQL statements.
2. (*) if the database does not provide variable binding, escape all variables that constitute the SQL statement.
3. Do not display the error information in the browser.
4. Set proper permissions for database users.
2. Operating System Command Line injection
1. (*) Avoid using a language that can start shell commands.
2. If shell commands can be started in the language used, you must check all variables of the parameter types of this function to ensure that only valid operations are included.
3. Do not check path name parameters/Directory Traversal
1. (*) do not directly use externally passed parameters as file names.
2. (*) restrict the file opening operation to a fixed directory and prohibit the file name from containing the path.
3. Set correct access permissions for files on the Web server
4. Check the file name
4. session management problems
1. (*) use difficult-to-guess content as the session ID
2. (*) do not save the session ID in the URL
3. (*) set the secure attribute for the cookie used in the https protocol
4. (*) generate a new session after successful logon.
5. (*) after successful logon, a secret information is generated out of the session ID, which is checked every time the page is accessed.
6. Do not use a fixed value as the session ID
7. Set the validity period when saving the session ID to the Cookie.
5. Cross-site scripting (XSS)
* Solution when HTML content cannot be entered
1. (*) escape all content output to the page
2. (*) when outputting a URL, only URLs starting with "http: //" or "https: //" are allowed.
3. (*) do not dynamically generate the content of <script>... </script>
4. (*) do not read style sheets from external websites.
5. Check input content
* Solution when HTML content is allowed
1. (*) parse the entered HTML content, generate the parsing tree, and then extract the non-script part.
2. Use a script to delete related strings in the input HTML content
* General Solution
1. (*) re-specify the charset attribute of Content-Type in the HTTP header of the response
2. To prevent Cookie information leakage, the Trace method should be disabled and the HttpOnly attribute should be set for all cookies.
6. Cross-Site Request Forgery (CSRF)
1. (*) All pages are accessed through POST. A random information is generated in the hidden of the previous page. After the submitted page is checked, the information is executed only when the information is correct.
2. (*) enter the password again before executing the business.
3. (*) check whether the Referer is correct. It is executed only when the Referer is correct.
4. send emails to the pre-configured email address when performing important operations
7. HTTP header Injection
1. (*) does not directly output the HTTP header, but uses the header information output API provided by the runtime environment.
2. (*) when you cannot use the API, disable line breaks in the entered header information.
3. Delete line breaks from all external inputs
8. Email theft (sending emails to a specified address by attackers through some means)
1. (*) do not use external parameters as the mail header information
2. Dangerous characters must be deleted when the header information must be set with external parameters.
From: http://tech.idv2.com/2008/04/19/secure-website-checklist/
