SQL injection and XSS prevention in HLD - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SQL Injection?

SQL Injection is a security vulnerability where attackers insert malicious SQL code into input fields to manipulate the database and access or modify data without permission.

beginner

How can parameterized queries help prevent SQL Injection?

Parameterized queries separate SQL code from data inputs, so user inputs are treated only as data, not executable code, preventing attackers from injecting harmful SQL commands.

beginner

What is Cross-Site Scripting (XSS)?

XSS is a security flaw where attackers inject malicious scripts into web pages viewed by other users, allowing theft of information or control over user actions.

intermediate

Name two common methods to prevent XSS attacks.

1. Escaping user inputs before displaying them on web pages. 2. Using Content Security Policy (CSP) headers to restrict script execution.

beginner

Why is input validation important in preventing SQL Injection and XSS?

Input validation ensures only expected and safe data is accepted, reducing the chance of malicious code entering the system and causing harm.

Which technique is most effective in preventing SQL Injection?

A Using parameterized queries

B Encrypting the database

C Using complex passwords

D Disabling user input

Parameterized queries keep user input separate from SQL commands, stopping injection attacks.

What does XSS stand for?

A Extra Secure Script

B Cross Server Security

C Cross System Sync

D Cross-Site Scripting

XSS means Cross-Site Scripting, a type of web security vulnerability.

Which of these helps prevent XSS attacks?

A Escaping user inputs

B Using SQL queries

C Disabling HTTPS

D Increasing server RAM

Escaping user inputs stops malicious scripts from running in browsers.

What is a Content Security Policy (CSP)?

A A password policy

B A database encryption method

C A browser security feature to control resources loaded

D A network firewall

CSP helps prevent XSS by restricting which scripts can run on a web page.

Why should user inputs be validated?

A To speed up the server

B To ensure data is safe and expected

C To increase database size

D To allow all inputs

Validating inputs helps block harmful or unexpected data that could cause security issues.

Explain how parameterized queries prevent SQL Injection attacks.

Think about how the database understands commands versus data.

Describe two ways to prevent Cross-Site Scripting (XSS) in web applications.

Consider both input handling and browser security settings.