DevNet Associate (DEVASC) v1.0Application Deployment and SecurityMedium
A developer is implementing a new API endpoint that will receive user-submitted data. To prevent common web vulnerabilities, such as Cross-Site Scripting (XSS) and SQL Injection, which security best practice should be applied to all incoming data before it is processed or stored?
- AHashing and Salting
- BURL Encoding
- CBase64 Encoding
- DInput Validation and Sanitization
Show answer & explanationAnswer & explanation
Correct answer: D. Input Validation and Sanitization
Input validation ensures data conforms to expected formats and types, while sanitization removes or neutralizes malicious characters or scripts. This combined approach is crucial for preventing XSS by removing script tags and SQL Injection by escaping or rejecting dangerous characters in user input.
Why the other options are wrong
- A. Hashing and salting are used for securely storing passwords, not for preventing injection attacks on general user-submitted data.
- B. URL encoding converts unsafe characters for use in URLs, but doesn't remove or neutralize malicious content for XSS or SQL injection.
- C. Base64 encoding converts binary data to ASCII string format; it's not a security measure against XSS or SQL injection.
Input Validation & Sanitization
Input validation checks if user-submitted data conforms to expected formats and constraints, while sanitization cleans or neutralizes potentially malicious content to prevent injection attacks.
- Prevents XSS, SQL Injection, Command Injection.
- Validation checks format, type, length, range.
- Sanitization removes or escapes dangerous characters.
- Apply to all untrusted input.
Memory trick: Validate and Sanitize: Filter out the bad stuff.