Web Application Security Guide/Miscellaneous points  From
Wikibooks, open books for an open world < Web Application
Security Guide Jump to: navigation, search  Miscellaneous points
This section contains some general security hints for web
applications.  Always remember    • Ensure debug output and
error messages do not leak sensitive information   • Do not use
“eval()” and similar functions     • Avoid “system()” and
similar functions if possible   • Ensure database servers are
not directly reachable from the outside   • Consider to block
old browsers from using your application   Web Application
Firewalls (WAFs) can prevent existing security holes from being
abused. They will make attacking your web application
significantly harder and more annoying for the attacker,
increasing the probability that a non-determined attacker will
move on to a different target. However, they can usually be
bypassed by a determined attacker. Your actual defense is to
secure your applications. The WAF is there to provide some a