SecurityInnovation/TMContentReview — Issue #99: How to Protect From Injection Attacks
Author: SergeTruth
Created: 2011-11-07 22:43:43+00:00
State: open

I still do not like the wording of the guidance sounding like HTML encoding solves all of your XSS problems. There needs to be a discussion of contexts and DOM based XSS (especially because of Web 2.0)

To see the effect of the HTML encoding, place the preceding page in a virtual directory, browse to it, enter some HTML code in the input text box, and click Submit. For example, the following input is rendered as text.
The safe and non-safe code examples look the same.

Use Parameters Collection When You Call a Stored Procedure
If the stored procedure itself uses dynamic SQL then you will still have SQL injection.

You also need to specify a character set to avoid UTF-7 attacks or other character set based attacks.