This presentation was given to some fresh graduate developers to help them understand how to protect their web apps against some famous attacks like XSS . the presentation was a part of a bigger course that was designed to asset them

1. OOP =Must
Design and Architecture  Must
Security  Must (Top important)
-----------------------------------
Unit testing driven TDD = Must (Gnedy ?)
Framework = Should
SOA = May be
Real life experience with PHP in real situations
New Topics

2. The 5 Most Common attacks and how to
prevent them ?

4. SELECT * FROM users WHERE username='john' AND password='123456'
SELECT * FROM users WHERE username='john' OR 1=1; -- '
AND The snippet would possibly allow the user to bypass the login screen without having proper credentials.

5.  Never trust User input
 Sanatize by mysqli_real_escape_string
 Casting
 Parameter query
 Limited permission , never use sa
 Test using http://sqlmap.org/ tool
 Encrypt sensitive data
 Don’t store sensitive data if you don’t need it

7.  Mandate strong passwords
 Secure reset password mechanism
 Use Recaptcha or captcha
 Use security Question
 Notify by email at any profile changes!
 Avoid “admin” user name
 Single token request , also protecte against
CSRF attacks .
 Encrypt password with strong algorism + salt

9.  Use Session_Regenerate_id to regenerate
session ID with each request
 Delete cookie from client once log out
 Limit session idle time
 Enable https or make it easy to be enabled,
how ?
 Protected your cookies not to be accessed by
Java Script at all !

11.  Validate , sanitize each input
 Escape Each Output
 Regester Globals OFF
 Check the security class of codegniter
 File system permission.

13.  Prevent error reporting at run time
 Prevent descriptive responses
 URL re-writing for SEO and for protection
 Make sure you got the latest version of any
3rd prty tool you are using .

14.  You use request token to prevent which
attack ?
 A) CSRF
 B) Password Brutal attack
 C) Sql injection
 D) XSS
 E) A and B
 F) C and D
 G) All the above

15.  You should configure your cookies to be
accessed only via
 A) Java script
 B) Cookie
 C) Http
 D) all the above .

16.  A)The cookie can not be accessed by JavaScript
 B)The cookie will not be sent cross-domain
 C)Client will send the cookie only over an HTTPS
connection

17.  A client logs in
 A short idle period (ie. 30 seconds)
 Any privilege level change
 Each request