How do you sanitize user input to avoid attacks?

2 Why is sanitizing user input important?

Sanitizing user input is important as it can protect your application from various types of attacks. For example, SQL injection occurs when an attacker inserts SQL commands into user input and can result in data theft or damage. Cross-site scripting (XSS) happens when an attacker injects HTML or JavaScript code into user input and can lead to session hijacking and malware installation. Command injection is when an attacker inserts system commands into user input which can cause remote code execution or system compromise. Therefore, it is essential to sanitize user input to ensure the security of your application.

3 How to sanitize user input for SQL injection?

To sanitize user input for SQL injection, you should use parameterized queries or prepared statements instead of concatenating user input with SQL statements. Parameterized queries or prepared statements separate the user input from the SQL commands and prevent them from being interpreted as part of the query. For example, in PHP, you can use PDO or mysqli to execute parameterized queries or prepared statements. Here is an example of a parameterized query using PDO:

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username);
$stmt->execute();        

4 How to sanitize user input for XSS?

To sanitize user input for XSS, you should encode or escape any HTML or JavaScript characters or tags from the input before displaying it on a web page. Encoding or escaping means replacing the characters or tags with their corresponding entities or symbols that are not interpreted by the browser. For example, in PHP, you can use htmlentities or htmlspecialchars to encode user input. Here is an example of encoding user input using htmlentities: echo htmlentities($input, ENT_QUOTES, 'UTF-8');

5 How to sanitize user input for command injection?

To sanitize user input for command injection, you should filter or validate any system commands or arguments from the input before executing them on the application server. Filtering or validating means removing or rejecting any invalid or dangerous input that may compromise the system. For example, in PHP, you can use escapeshellcmd or escapeshellarg to filter user input. Here is an example of filtering user input using escapeshellcmd:

$command = escapeshellcmd($input);
$output = shell_exec($command);