SQL injection and xss vulnerability

What is sqlinjection?

The user forms the SQL query statement by inputting parameters, so that the user can control the SQL query statement

Defense methods:

1. Bind variables, use pre-parsed statements
2. Check variable data type and format
3. Filter special symbols

What is a xssvulnerability?

By inserting a piece of malicious script code into the web page, the user will execute this script code when accessing the web page, and some malicious information may be stored in the database, and the malicious information will be rendered from the database to the web page the next time the page is accessed , Causing an attack

Defense methods:

1. Effectively filter user input, only allow input of specified length or content
2. Entity number for HTML entities, such as: <--- & lt;
3. JavaScript code untrusted data, and only put the data in the value enclosed in quotation marks
4. Most of the purpose of the xss attack is to get the user's cookie, so set the important cookie to httponly, so that you can't get the cookie through the document.cookie in the script