Injection

Required

• Use parameterised queries

  Required

  Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings.

• Escape everything you show

  Required

  Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy.

• Never pass input to a shell

  Required

  Run other programs without a shell, with input as separate arguments. Better still, use a library instead of a program.

• Keep input out of templates

  Required

  Pass user input to a template as data. Never use it as the template itself.

• Strip line breaks from headers and logs

  Required

  Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.

• Turn off external entities in XML

  Required

  Parse XML with external entities and document types turned off, or accept JSON instead.

• Never rebuild objects from untrusted data

  Required

  Read untrusted data only as plain data, such as JSON. Never use formats that can rebuild code objects.

• Block prototype pollution

  Required

  In JavaScript, never merge or copy untrusted objects in a way that lets keys such as __proto__ change every object in the app.