Secure coding best practices - Learn Tech From Zero

2.5 Explain concepts related to vulnerability response, handling, and management.

📘CompTIA CySA+ (CS0-003)

Secure coding means writing software in a way that prevents security problems. Poor coding can leave applications open to attacks like data leaks, unauthorized access, or malware infections. Following best practices ensures that the software is safer for users and the organization.

Here are the key practices you need to know:

1. Input Validation

What it is:
Input validation ensures that any data coming into a system is checked for correctness before it’s used. This helps prevent attacks like SQL injection or cross-site scripting (XSS).

How it works in IT:

Suppose a web application asks for a username. Input validation ensures only letters and numbers are accepted.
If someone tries to enter harmful code like <script>alert('hack')</script>, input validation blocks it.

Key points to remember for the exam:

Validate all input, including from forms, APIs, or files.
Use whitelists (allowed data) instead of blacklists (blocked data) because whitelists are safer.
Types of validation: length, format, type, range, and characters.

2. Output Encoding

What it is:
Output encoding ensures that data sent from your system to the user is treated safely, especially in web browsers. It prevents malicious code from executing.

IT example:

A user submits a comment on a website. If the website directly shows <script>alert('hack')</script> in the comment section, it could run in another user’s browser.
With output encoding, the system converts < to < and > to >, so it displays as text instead of executing.

Key points:

Always encode output to browsers, logs, or files.
Use encoding libraries in your programming language (e.g., htmlspecialchars() in PHP, or encodeForHTML() in Java).

3. Session Management

What it is:
Session management keeps track of users’ activities while they are logged in. Poor session management can allow attackers to steal sessions and impersonate users.

IT example:

When you log into a website, the system gives you a session ID.
Secure session management makes sure this ID:
- Is unique for each login
- Expires after inactivity
- Is transmitted securely (over HTTPS)

Key points for the exam:

Use secure cookies and set flags like HttpOnly and Secure.
Regenerate session IDs after login to prevent session fixation.
Limit session timeouts for sensitive applications.

4. Authentication

What it is:
Authentication is how a system verifies who a user is. Strong authentication prevents unauthorized access.

IT example:

Passwords must be stored using hashing algorithms (like SHA-256) so even if the database is stolen, passwords aren’t easily readable.
Multi-factor authentication (MFA) adds a second layer, such as a code sent to a user’s email or phone.

Key points:

Never store passwords in plain text.
Use strong password policies (length, complexity, expiration).
Consider MFA for sensitive systems.

5. Data Protection

What it is:
Data protection ensures that sensitive information is encrypted and safe both at rest (in storage) and in transit (over the network).

IT example:

A web server stores customer credit card numbers encrypted using AES-256.
Data sent from a web form to the server uses HTTPS, which encrypts the data in transit.

Key points:

Use encryption for sensitive data.
Protect encryption keys securely.
Consider access control to limit who can read or modify data.

6. Parameterized Queries

What it is:
Parameterized queries (or prepared statements) prevent SQL injection attacks by separating SQL code from user input.

IT example:

Unsafe query:

SELECT * FROM users WHERE username = ' " + userInput + " ';

Safe parameterized query:

SELECT * FROM users WHERE username = ?;

Here, the ? ensures user input cannot change the SQL command.

Key points:

Always use parameterized queries for database access.
Avoid building SQL queries by concatenating strings with user input.

✅ Summary for the Exam

Best Practice	Why It Matters
Input validation	Prevents harmful data from entering the system
Output encoding	Prevents malicious code from running in the browser or logs
Session management	Keeps users’ sessions secure and prevents hijacking
Authentication	Confirms users are who they claim to be
Data protection	Ensures sensitive data is encrypted in storage and transit
Parameterized queries	Prevents SQL injection by separating code from data

Tip for the exam: Many questions test cause and effect: “Which secure coding practice prevents X?” Always think what problem each practice solves.