So let us conclude our SQL injection topic with the countermeasures that we need to enforce so that
its attacks won't happen.
The first and the most important thing is you have to make no assumptions about the size type or the
content of the data that the user will input, then avoid constructing dynamic ESKIL with concatenated
input values, ensure that the Web configuration files for each application do not contain sensitive
information, sanitize the input, for example, cut the extra HTML characters tags that numbers are
required.
Isolative Observatoire locking it in different domains then ensure all the software patches are updated
regularly.
Regular monitoring of Eskil statements from databases connected applications to identify malicious SQL
statements and the most important thing is the not disclosed database error information to the end users.
We saw Hoelter bathed or as could happen and errors are the most important thing, which help in throwing
out valuable information.
Then use a secure hash algorithm such as S.A.G. 256 to store the user passwords than in plain text,
also validate user supplied data that is sanitisation, then ensure that all user inputs are sanitized
before using them in dynamic ESKIL statements about the use of any Web application which is not tested
by the Web.
So then ensure that the coder tracing and debug messages are removed prior to deploying an application
and finally use data access abstraction layer to enforce secure data access across the entire application,
not common attacks.
Use a specific type of code sequences that allow attackers to gain an unauthorized access.
So make sure that the application does not accept any kind of external tags, inputs, open brackets
close.
For example, if the application is asking for the name of the user, you just have to allow the characters
from A to Z.
That is the alphabets.
In this way, preventing database is one of the most toughest and important job nowadays, many hackers
have a database and reveal the credentials and actually sell them on the web.
So this is really very necessary and important for any security expert to prevent discrimination attacks.
In the next lecture, you will have a brief introduction to cross site scripting that is Exercice.