Improving Web Application Security: Threats and - CGISecurity

370 Part III: Building Secure Web ApplicationsCountermeasuresTo counter SQL injection attacks, be sure to:● Constrain and sanitize input data.● Use type safe SQL parameters for data access. These parameters can be used withstored procedures or dynamically constructed SQL command strings. Parametersperform type and length checks and also ensure that injected code is treated asliteral data, not executable statements in the database.● Use an account that has restricted permissions in the database. Ideally, you shouldonly grant execute permissions to selected stored procedures in the database andprovide no direct table access.Disclosure of Configuration DataThe most sensitive configuration data used by data access code is the databaseconnection string. If a compromised connection string includes a user name andpassword, the consequences can be greater still.VulnerabilitiesThe following vulnerabilities increase the security risk associated with compromisedconfiguration data:● Use of SQL authentication, which requires credentials to be specified in theconnection string● Embedded connection strings in code● Clear text connection strings in configuration files● Failure to encrypt a connection stringCountermeasuresTo prevent disclosure of configuration data:● Use Windows authentication so that connection strings do not contain credentials.● Encrypt the connection strings and restrict access to the encrypted data.Disclosure of Sensitive Application DataMany applications store sensitive data, such as customer credit card numbers. It isessential to protect the privacy and integrity of this type of data.VulnerabilitiesCoding practices that can lead to the disclosure of sensitive application data include:● Storing data with no encryption● Weak authorization● Weak encryption