05eb0a61_P_Top_Ten_Cheat_Sheet____OWASP__1
[0] A1 Injection [2] Canonicalize using correct character set Positive input validation using correct character set (NR) Negative input validation (LR) Sanitize input Tip: updating a negative list (such as looking for "script", "sCrIpT", "ßCrîpt", etc) will require expensive and constant deployments and will always fail as attackers work out your list of "bad" words. Positive validation is simpler, faster and usually more secure and needs updating far less than any other validation mechanism. [3] Parameterized queries Object relational model (Hibernate) Active Record design pattern Stored procedures Escape mechanisms such as ESAPI's Encoder.EncodeForLDAP() or Encoder.EncodeforOS() Tip: All SQL Injection is due to dynamic SQL queries. Strongly consider prohibiting dynamic SQL queries within your organization [1] 
Avoid or prohibit hidden fields, custom headers or cookies Render: Set a correct content type Set safe character set (UTF-8) Set correct locale On Submit: Enforce input field type and lengths Validate fields and provide feedback Ensure option selects and radio contain only sent values
Difference between revisions of "OWASP Top Ten Cheat Sheet" - OWASP