Escaping output may help protect from which common security vulnerabilities?





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







1
















  • Clickjacking

  • Cross-Site Scripting

  • Cross-Ste Request Forgery

  • SQL Injection


This question is part of PHP 7 certification guide by ZEND. The provided answer in the guide seems to be wrong!
My answer is Cross-Site Scripting. However the answer provided by guide is "Cross-Site Scripting" & "SQL Injection". This doesn't sound correct. Escaping input can protect against SQL inject. Please correct me if I am wrong!?










share|improve this question





























    1
















    • Clickjacking

    • Cross-Site Scripting

    • Cross-Ste Request Forgery

    • SQL Injection


    This question is part of PHP 7 certification guide by ZEND. The provided answer in the guide seems to be wrong!
    My answer is Cross-Site Scripting. However the answer provided by guide is "Cross-Site Scripting" & "SQL Injection". This doesn't sound correct. Escaping input can protect against SQL inject. Please correct me if I am wrong!?










    share|improve this question

























      1












      1








      1









      • Clickjacking

      • Cross-Site Scripting

      • Cross-Ste Request Forgery

      • SQL Injection


      This question is part of PHP 7 certification guide by ZEND. The provided answer in the guide seems to be wrong!
      My answer is Cross-Site Scripting. However the answer provided by guide is "Cross-Site Scripting" & "SQL Injection". This doesn't sound correct. Escaping input can protect against SQL inject. Please correct me if I am wrong!?










      share|improve this question















      • Clickjacking

      • Cross-Site Scripting

      • Cross-Ste Request Forgery

      • SQL Injection


      This question is part of PHP 7 certification guide by ZEND. The provided answer in the guide seems to be wrong!
      My answer is Cross-Site Scripting. However the answer provided by guide is "Cross-Site Scripting" & "SQL Injection". This doesn't sound correct. Escaping input can protect against SQL inject. Please correct me if I am wrong!?







      php zend-framework zend-studio






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 22 '18 at 3:10









      AmirAmir

      84




      84
























          1 Answer
          1






          active

          oldest

          votes


















          0














          Yeah, I think you're absolutely correct. I think your certification guide is wrong. Seems like a wonky question to begin with though anyway.



          In both XSS and SQL Injection, the key here is that arbitrary data is used in a context without translating it to that context. In a way, this is all about disambiguating the "data" from the "command".



          For HTML, the "data" is this arbitrary data that is presumably text. If you want to use text in HTML, you have to escape the reserved characters so that text isn't interpreted as HTML.



          Likewise in SQL, if you're going to concatenate arbitrary values into a query, you need to make sure they don't get interpreted as part of the query itself (like quote marks or something), or you're going to have a bad day. (Better yet, fundamentally separate the data from the query itself using prepared/parameterized queries, and this becomes a non-issue.)



          It makes no sense that escaping output has anything to do with SQL injection... unless that "output" is a query being output to a database server.



          (Related: https://stackoverflow.com/a/7810880/362536)






          share|improve this answer
























            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53423322%2fescaping-output-may-help-protect-from-which-common-security-vulnerabilities%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            0














            Yeah, I think you're absolutely correct. I think your certification guide is wrong. Seems like a wonky question to begin with though anyway.



            In both XSS and SQL Injection, the key here is that arbitrary data is used in a context without translating it to that context. In a way, this is all about disambiguating the "data" from the "command".



            For HTML, the "data" is this arbitrary data that is presumably text. If you want to use text in HTML, you have to escape the reserved characters so that text isn't interpreted as HTML.



            Likewise in SQL, if you're going to concatenate arbitrary values into a query, you need to make sure they don't get interpreted as part of the query itself (like quote marks or something), or you're going to have a bad day. (Better yet, fundamentally separate the data from the query itself using prepared/parameterized queries, and this becomes a non-issue.)



            It makes no sense that escaping output has anything to do with SQL injection... unless that "output" is a query being output to a database server.



            (Related: https://stackoverflow.com/a/7810880/362536)






            share|improve this answer




























              0














              Yeah, I think you're absolutely correct. I think your certification guide is wrong. Seems like a wonky question to begin with though anyway.



              In both XSS and SQL Injection, the key here is that arbitrary data is used in a context without translating it to that context. In a way, this is all about disambiguating the "data" from the "command".



              For HTML, the "data" is this arbitrary data that is presumably text. If you want to use text in HTML, you have to escape the reserved characters so that text isn't interpreted as HTML.



              Likewise in SQL, if you're going to concatenate arbitrary values into a query, you need to make sure they don't get interpreted as part of the query itself (like quote marks or something), or you're going to have a bad day. (Better yet, fundamentally separate the data from the query itself using prepared/parameterized queries, and this becomes a non-issue.)



              It makes no sense that escaping output has anything to do with SQL injection... unless that "output" is a query being output to a database server.



              (Related: https://stackoverflow.com/a/7810880/362536)






              share|improve this answer


























                0












                0








                0







                Yeah, I think you're absolutely correct. I think your certification guide is wrong. Seems like a wonky question to begin with though anyway.



                In both XSS and SQL Injection, the key here is that arbitrary data is used in a context without translating it to that context. In a way, this is all about disambiguating the "data" from the "command".



                For HTML, the "data" is this arbitrary data that is presumably text. If you want to use text in HTML, you have to escape the reserved characters so that text isn't interpreted as HTML.



                Likewise in SQL, if you're going to concatenate arbitrary values into a query, you need to make sure they don't get interpreted as part of the query itself (like quote marks or something), or you're going to have a bad day. (Better yet, fundamentally separate the data from the query itself using prepared/parameterized queries, and this becomes a non-issue.)



                It makes no sense that escaping output has anything to do with SQL injection... unless that "output" is a query being output to a database server.



                (Related: https://stackoverflow.com/a/7810880/362536)






                share|improve this answer













                Yeah, I think you're absolutely correct. I think your certification guide is wrong. Seems like a wonky question to begin with though anyway.



                In both XSS and SQL Injection, the key here is that arbitrary data is used in a context without translating it to that context. In a way, this is all about disambiguating the "data" from the "command".



                For HTML, the "data" is this arbitrary data that is presumably text. If you want to use text in HTML, you have to escape the reserved characters so that text isn't interpreted as HTML.



                Likewise in SQL, if you're going to concatenate arbitrary values into a query, you need to make sure they don't get interpreted as part of the query itself (like quote marks or something), or you're going to have a bad day. (Better yet, fundamentally separate the data from the query itself using prepared/parameterized queries, and this becomes a non-issue.)



                It makes no sense that escaping output has anything to do with SQL injection... unless that "output" is a query being output to a database server.



                (Related: https://stackoverflow.com/a/7810880/362536)







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Nov 22 '18 at 3:13









                BradBrad

                117k29239398




                117k29239398
































                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53423322%2fescaping-output-may-help-protect-from-which-common-security-vulnerabilities%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    鏡平學校

                    ꓛꓣだゔៀៅຸ໢ທຮ໕໒ ,ໂ'໥໓າ໼ឨឲ៵៭ៈゎゔit''䖳𥁄卿' ☨₤₨こゎもょの;ꜹꟚꞖꞵꟅꞛေၦေɯ,ɨɡ𛃵𛁹ޝ޳ޠ޾,ޤޒޯ޾𫝒𫠁သ𛅤チョ'サノބޘދ𛁐ᶿᶇᶀᶋᶠ㨑㽹⻮ꧬ꧹؍۩وَؠ㇕㇃㇪ ㇦㇋㇋ṜẰᵡᴠ 軌ᵕ搜۳ٰޗޮ޷ސޯ𫖾𫅀ल, ꙭ꙰ꚅꙁꚊꞻꝔ꟠Ꝭㄤﺟޱސꧨꧼ꧴ꧯꧽ꧲ꧯ'⽹⽭⾁⿞⼳⽋២៩ញណើꩯꩤ꩸ꩮᶻᶺᶧᶂ𫳲𫪭𬸄𫵰𬖩𬫣𬊉ၲ𛅬㕦䬺𫝌𫝼,,𫟖𫞽ហៅ஫㆔ాఆఅꙒꚞꙍ,Ꙟ꙱エ ,ポテ,フࢰࢯ𫟠𫞶 𫝤𫟠ﺕﹱﻜﻣ𪵕𪭸𪻆𪾩𫔷ġ,ŧآꞪ꟥,ꞔꝻ♚☹⛵𛀌ꬷꭞȄƁƪƬșƦǙǗdžƝǯǧⱦⱰꓕꓢႋ神 ဴ၀க௭எ௫ឫោ ' េㇷㇴㇼ神ㇸㇲㇽㇴㇼㇻㇸ'ㇸㇿㇸㇹㇰㆣꓚꓤ₡₧ ㄨㄟ㄂ㄖㄎ໗ツڒذ₶।ऩछएोञयूटक़कयँृी,冬'𛅢𛅥ㇱㇵㇶ𥄥𦒽𠣧𠊓𧢖𥞘𩔋цѰㄠſtʯʭɿʆʗʍʩɷɛ,əʏダヵㄐㄘR{gỚṖḺờṠṫảḙḭᴮᵏᴘᵀᵷᵕᴜᴏᵾq﮲ﲿﴽﭙ軌ﰬﶚﶧ﫲Ҝжюїкӈㇴffצּ﬘﭅﬈軌'ffistfflſtffतभफɳɰʊɲʎ𛁱𛁖𛁮𛀉 𛂯𛀞నఋŀŲ 𫟲𫠖𫞺ຆຆ ໹້໕໗ๆทԊꧢꧠ꧰ꓱ⿝⼑ŎḬẃẖỐẅ ,ờỰỈỗﮊDžȩꭏꭎꬻ꭮ꬿꭖꭥꭅ㇭神 ⾈ꓵꓑ⺄㄄ㄪㄙㄅㄇstA۵䞽ॶ𫞑𫝄㇉㇇゜軌𩜛𩳠Jﻺ‚Üမ႕ႌႊၐၸဓၞၞၡ៸wyvtᶎᶪᶹစဎ꣡꣰꣢꣤ٗ؋لㇳㇾㇻㇱ㆐㆔,,㆟Ⱶヤマފ޼ޝަݿݞݠݷݐ',ݘ,ݪݙݵ𬝉𬜁𫝨𫞘くせぉて¼óû×ó£…𛅑הㄙくԗԀ5606神45,神796'𪤻𫞧ꓐ㄁ㄘɥɺꓵꓲ3''7034׉ⱦⱠˆ“𫝋ȍ,ꩲ軌꩷ꩶꩧꩫఞ۔فڱێظペサ神ナᴦᵑ47 9238їﻂ䐊䔉㠸﬎ffiﬣ,לּᴷᴦᵛᵽ,ᴨᵤ ᵸᵥᴗᵈꚏꚉꚟ⻆rtǟƴ𬎎

                    Why https connections are so slow when debugging (stepping over) in Java?