the-web-application-hackers-handbook

56 Chapter 3 n Web Application Technologies
To implement the functionality they need, web applications may incorporate
user-supplied input into SQL queries that are executed by the back-end database.
If this process is not carried out safely, attackers may be able to submit
malicious input to interfere with the database and potentially read and write
sensitive data. These attacks are described in Chapter 9, along with detailed
explanations of the SQL language and how it can be used.
XML
Extensible Markup Language (XML) is a specification for encoding data in a
machine-readable form. Like any markup language, the XML format separates
a document into content (which is data) and markup (which annotates
the data).
Markup is primarily represented using tags, which may be start tags, end
tags, or empty-element tags:
Start and end tags are paired into elements and may encapsulate document
content or child elements:
ginger
spotpaws
Tags may include attributes, which are name/value pairs:
...
XML is extensible in that it allows arbitrary tag and attribute names. XML
documents often include a Document Type Definition (DTD), which defines
the tags and attributes used in the documents and the ways in which they can
be combined.
XML and technologies derived from it are used extensively in web applications,
on both the server and client side, as described in later sections of this
chapter.
Web Services
Although this book covers web application hacking, many of the vulnerabilities
described are equally applicable to web services. In fact, many applications are
essentially a GUI front-end to a set of back-end web services.