Security questions about the Web

Recent web security issues are summarized as follows:

One, cross-site scripting attacks (XSS)

Inserting malicious code into a Web page is primarily a place that involves user input.

Never trust the user's input. Tests are required (such as escaping when special characters are displayed).

Second, cross-site request forgery (CSRF)

Forge a connection request, sending a request as a user without knowing the user's identity.

Note: Use token or verification code to detect user submissions.

The client is best to use the POST request, the server side should also use the Post check request mode.

Security questions about the Web