Website Hacking Techniques and their workarounds

Cross-site Request Forgery:

Sometimes, hackers make an API call to another website. It is called fake identity or false authorization
To prevent CSRF, we add an input element with type "hidden" and a _token to the value of a 32 character token that is sent by the server to the client in the first response.
After this, the client will send this token in the hidden field every time the client makes HTTP requests to the server
Hence, the server matches the token sent by the client to the token stored by the server at every clientHTTP request, and if it matches, it means , that the cliengt is a genuine client.

For some pages in a website,
We don't want this authorization to take place, hence we disable the token field in the HTTP request for that web page.

SQL Injection:- Sometimes, in a form, which has input fields, the user enters random values like '1'='1' in the textfield
If, on the server
the SQL statement is like

      
 sql = select * from users
       where username=$_POST["username"] and password=$_POST["password"] or $_POST["date"]
    
    

Here, if one enters date = <"1" = "1">
It will return true, even if the name or password is fake
htmlspecialchars() function to convert html special charcters to their encoded values and in SQL in the database server,
We use prepared statement like:

    
    sql = "select * from table1
    where name = ? and password = ?
    otr date= ?
    
    

Then we bind the parameters values to the question mark
In URLs, the special charcters are encode into encoded charcters
For example

• <space> is converted to + or %20
• " is converted %3D
• ' is converted to %3E and so on

XSS (Cross Site Scripting)

In XSS, hackers type special HTML5 characters like < and > and so on that are interpreted as HTML5 markup and are formatted and sent that spam data to the server

Let us look at an example: