Web Security Statistics
The following graph shows the most common vulnerabilities in web applications. (Source: webappsec.org)
“ 90% Websites Have Vulnerabilities ”WhiteHat Security
The following graph shows the most common vulnerabilities in web applications. (Source: webappsec.org)
“ 90% Websites Have Vulnerabilities ”WhiteHat Security
Local or remote file inclusion occurs when a script tries to include a user determined file. Attackers can exploit this flaw to read configuration files or critical system files.
This vulnerability can be patched by hard coding the files that are safe to include.
SQL injection occurs when user input to a database query is not properly sanitized. This allows attackers to send arbitrary querys to your database.
Attackers will be able to extract details in your database such as administrator passwords, customer's private details, and even credit card numbers.
To protect yourself from SQL injection you need to sanitize the strings that are conducting querys. There are various functions that do this for you, such as PHP's mysql_real_escape_string()
Cross-Site Scripting occurs when user input is not sanitized when input is printed to the screen. If malicous code is not filtered out, it can become part of the page's code and thus executed on the client side. Usually this vulnerability is exploited to "catch" user's cookies. If exploited sucessfully, the attacker can login to a user's account without a password.There are many things a creative attacker can do with this vulnerability.
XSS can be easily prevented by removing html tags before printing the input to the page. This can be done in PHP using htmlentities() or strip_tags()