Input validation, output encoding, parameterized queries, secrets management, memory safety, dependency risk and secure SDLC.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What is input validation?
Show answer
The process of checking that user input conforms to expected formats, types, and ranges before processing.- What is a whitelist approach to input validation?
Show answer
Explicitly allow only known good values or patterns; reject everything else.- What is a blacklist approach to input validation?
Show answer
Explicitly block known dangerous values or patterns; allow everything else.- Where should input validation occur?
Show answer
On the server side; client-side validation is a convenience, not a security boundary.- Why is server-side validation necessary even when client-side validation exists?
Show answer
Client-side validation can be bypassed by an attacker; server-side is the actual security control.- What is boundary value testing?
Show answer
Testing input at edge cases such as zero, negative numbers, empty strings, and maximum lengths.- What is output encoding?
Show answer
Converting special characters into safe representations for the output context to prevent injection attacks.- What is HTML encoding?
Show answer
Converting characters like <, >, &, and quotes into HTML entities so they render as text, not code.- When is URL encoding used?
Show answer
When including data in URLs to ensure special characters like spaces and symbols are safely transmitted.- Why must output encoding be context-specific?
Show answer
Different contexts (HTML, JavaScript, CSS, URL) have different dangerous characters; wrong encoding for the context fails to prevent attacks.- What is SQL injection?
Show answer
An attack where malicious SQL code is inserted into user input, allowing an attacker to alter or bypass database queries.- What is a parameterized query?
Show answer
A query where placeholders separate SQL structure from data, and parameters are bound separately so user input cannot alter query structure.- Why are parameterized queries safer than string concatenation?
Show answer
The SQL structure is fixed before data is added; user input is treated as data only, never as executable code.- Can a stored procedure prevent SQL injection?
Show answer
Only if it uses parameterized queries internally; a stored procedure built with string concatenation is still vulnerable.- Which parts of a SQL statement can be parameterized?
Show answer
Data values in WHERE clauses and INSERT values; table names, column names, and SQL keywords cannot be parameterized.
FlashKeepers