Accepting submissions.
WHAT TO VALIDATE
Every field Type, length, format and range Whether required fields are present
WHERE TO VALIDATE
On the server, always.
Browser validation is convenience, not security. It can be bypassed entirely.
WHAT TO DO WITH INVALID INPUT
Return a clear error naming what was wrong, and redisplay the form with what they entered.
WHAT TO ESCAPE
Anything displayed back in a page.
WHY
So submitted content cannot be interpreted as markup or script.
Most frameworks escape by default. Know whether yours does.
WHAT TO PARAMETERISE
Anything reaching a database.
WHAT TO CHECK ON FILE UPLOADS
Type, by content rather than name Size Where it is stored Whether it can be executed
WHAT TO NEVER DO
Store uploads where they can be executed Trust the filename supplied
WHAT TO PROTECT AGAINST
Submissions from other sites acting as your user.
Frameworks provide protection. Ensure it is enabled.
WHAT TO RATE LIMIT
Anything that can be submitted repeatedly.
