Lesson 48 · Building systems

Secure coding: the common mistakes and their fixes

Most security holes in web apps come from a handful of well-known mistakes. Follow one request through a server with checkpoints: validate the input, check access on every request, keep SQL and data apart with parameterised queries, escape what you send back and add a Content-Security-Policy, keep secrets out of the code, keep libraries up to date, and give every account the least privilege it needs. Each mistake sits beside its fix.

14 min11 steps5 questionsAdvanced

Fig 48 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Which line is safe from SQL injection?

Only the parameterised query sends the value separately from the SQL. The other three all build the SQL text from the value, so the value can change the command.

02A logged-in user changes the address from /invoice/41 to /invoice/42 and sees someone else's invoice. What is missing?

This is broken access control, first in the OWASP Top 10 (2021). Being logged in is not enough: the server must check that this user may see this record, every time, and answer 403 Forbidden if not.

03What does html.escape do to a comment before it goes into a page?

Escaping changes the characters that HTML treats as markup into harmless entities. The text still shows the same, but the browser never runs it.

04Where should an API key for a payment service live?

Code is copied, shared and kept in version history. A secret in the environment or a secret store stays out of all of that, and can be changed without changing the code.

05Your web app's database account can also delete tables, though the app never needs to. Which principle does this break?

Least privilege means each part gets only the access its job needs. If a mistake slips through, an account that can only read and write rows can do far less harm.

Key terms

Glossary

Untrusted input: Anything that arrives from outside your program: form fields, the address, cookies, headers, files. Treat it as possibly wrong or hostile until checked.
Input validation: Checking that input has the shape you expect (a whole number, a short name) and rejecting the rest, ideally with an allow-list.
Injection: A mistake where user text is glued into a command (such as SQL) so the text can change what the command does.
Parameterised query: A query sent with placeholders (such as ?) and the values passed separately, so values are always treated as data.
Access control: Deciding on the server, for every request, whether this user may do this action on this record. Also called authorization.
Cross-site scripting (XSS): A mistake where user text is put into a web page as HTML, so the browser may run it as code. Fixed by escaping output.
Content-Security-Policy (CSP): A response header that tells the browser which scripts it may run, a second line of defence against XSS.
Least privilege: Giving each program, account or person only the access their job needs, so mistakes and breaches do less harm.

Fine print

Notes and sources

The card lines are short sketches of each pattern, not a whole program: escape is html.escape, environ is os.environ, deny() stands for answering 403 Forbidden, and q holds the query with a ? placeholder.
Rankings and names come from the OWASP Top 10, 2021 edition. In that edition cross-site scripting is part of A03 Injection. OWASP revises the list every few years; the fixes shown here stay the same.
Input validation catches bad shapes early, but OWASP says it is not the main defence against injection or XSS. Parameterised queries and output escaping are.
Python database drivers use different placeholder marks (PEP 249 paramstyle): sqlite3 uses ?, some others use %s. The idea is the same: the value never becomes part of the SQL text.
Which escaping is right depends on where the text goes: HTML body, an attribute, a URL or JavaScript each need their own. Template engines such as Jinja can escape HTML for you automatically.

Quiz Unlocks after the last step.