Section outline

  • Lesson Overview: This lesson focuses on defensive patterns to handle user input safely across the board. Building on injection attacks from Lesson 25, students will learn concrete coding practices and design patterns (like whitelisting, validation, encoding, least privilege) that prevent SQL injection, XSS, command injection, and similar input-based attacks.

    • Micro-Topic 26.1: Input Validation & Whitelisting – Only the Expected Enters

      ·       Learning Goal: Emphasize the importance of strict input validation – only allowing expected, well-formed data – and how whitelisting (accepting known good patterns) trumps blacklisting in preventing injection attacks.

    • microtopic 26 1 input validation whitelisting CONTENT v4 SCORM package

    • Micro-Topic 26.2: Parameterized Queries & ORM – SQL Injection Antidote

      ·       Learning Goal: Learn how using parameterized SQL queries (prepared statements) and Object-Relational Mappers (ORMs) prevents SQL injection by separating code from data, and understand their role as a standard defensive pattern in database interactions.

    • microtopic 26 2 parameterized queries orm CONTENT v4 SCORM package

    • Micro-Topic 26.3: Output Encoding & Contextual Escaping – Disarming XSS

      ·       Learning Goal: Focus on the pattern of encoding output according to context (HTML, JavaScript, URL, etc.) to prevent XSS and similar injection attacks on the client side. Students should grasp that sanitizing output is as important as input validation for safety.

    • microtopic 26 3 output encoding escaping CONTENT v4 SCORM package

    • Micro-Topic 26.4: Least Privilege & Safe APIs – Limiting Damage of Injection

      ·       Learning Goal: Understand the defensive principle of least privilege in context of injection prevention (e.g., database accounts with limited rights, OS commands running with minimal privileges) and using safer API methods (instead of risky ones) to reduce the impact of any injection that might occur.

    • microtopic 26 4 least privilege safe apis CONTENT v4 SCORM package

    • Micro-Topic 26.5: Regex and Sanitization – Filtering Out the Junk

      ·       Learning Goal: Discuss the use of regular expressions and other sanitization techniques to strip out or reject known harmful patterns (like script tags, SQL meta-characters) from input, while cautioning that this should be a secondary measure (after whitelisting) and done carefully to avoid over-filtering or being bypassed.

    • microtopic 26 5 regex sanitization CONTENT v4 SCORM package