security-patterns

SQL injection prevention relies on parameterized queries and prepared statements, which separate code from data. Use placeholders for user input rather than string concatenation, and validate all inputs against expected formats before querying the database.

The OWASP Top 10 includes Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software and Data Integrity Failures, Logging Deficiencies, and Server-Side Request Forgery. Each requires specific prevention strategies and secure coding patterns.

Secure password storage uses cryptographic hashing algorithms like bcrypt, which apply salt and multiple iterations to prevent rainbow table attacks. Never store plain-text passwords; hash them during registration and verify hashes during login.

Input validation requires whitelisting acceptable formats, rejecting unexpected data types, enforcing length limits, and sanitizing special characters. Validate on both client and server side, treat all user input as untrusted, and reject requests that violate defined patterns.

Manage secrets using environment variables, never hardcode credentials in source code, and rotate keys regularly. Use secure vaults or secret management systems for production deployments, and ensure secrets are excluded from version control and logs.

Security headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security prevent XSS, clickjacking, and man-in-the-middle attacks. Configure CORS policies restrictively, use HTTPS, disable unnecessary HTTP methods, and return generic error messages to avoid information disclosure.