The Biggest Risk That Developers Need to Care About?
Our Code
Our Users!
Make it EASY for Users to be Secure
But Never Trust Them
Basic Principles
- Never trust user input.
- Escape as late as possible.
- Escape everything from untrusted sources (like databases and users), third-parties (like Twitter), etc.
- Never assume anything.
- Never trust user input.
- Validation/rejection is better than sanitation.
- Never trust user input.
Validating: Checking
- Never rely solely on client-side validation
- Your friends:
empty()/isset(), mb_strlen()/strlen(), in_array(), is_*(), *_exists(), wp_validate_*()
Sanitizing: Cleaning
- Never rely solely on client-side sanitation
- Your friends:
sanitize_*(), esc_url_raw(), wp_filter_post_kses(), wp_filter_nohtml_kses()
Escaping: On Output
- Escape ALL variable output
- Your friends:
esc_*()
- Escape Late
// Okay, but not that great
$url = esc_url( $url );
$text = esc_html( $text );
echo '<a href="'. $url . '">' . $text . '</a>';
// Much better!
echo '<a href="'. esc_url( $url ) . '">' . esc_html( $text ) . '</a>';
It’s not if you get attacked, but rather how you prevent it from being successful.
Q & A
Aaron D. Campbell – @AaronCampbell
Slides: https://adcwp.me/okcmeetup2018
This presentation is running on WordPress using the Presenter plugin