Understanding and Preventing XSS Attacks in JavaScript Applications
One malicious string in the wrong text box, and an attacker is running code inside your users’ browsers, on your domain,
XSS prevention
Managing JavaScript Libraries: Best Practices for Reducing Security Risks
You add one small library to save an afternoon. It pulls in twelve more you never read. Six months later a
Defending Against Content Security Policy (CSP) Bypass: Best Practices for JavaScript Applications
You ship a Content Security Policy, see the header show up in DevTools, and feel safe. That feeling is the trap.
Upgrading PHP: Replacing Magic Quotes with Proper Input Sanitization
If you have ever inherited an old PHP codebase, you have probably met magic_quotes_gpc. It was PHP’s attempt to keep you
30 Days of JavaScript: Web Security and JavaScript, Day 29
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag