Hi Stas, On Thu, Nov 20, 2014 at 4:10 PM, Yasuo Ohgaki <yohg...@ohgaki.net> wrote:
> Please refer to CWE/SANS TOP 25, Monster Mitigation especially. > > http://cwe.mitre.org/top25/#Mitigations > > and ISO 27000. (I cannot provide link to it, since one should buy the > document to read) > > Programmer should control over all inputs as the most important security > measure. > There are two strategies in general. > > - Convert inputs to secure values and ignore possible attacks. > (Sanitization) > - Validate inputs to reject malformed values and record possible attacks. > (Validation and logging) > > (int) is sanitization. It works, but it cannot log/detect possible attack > (or bug). > > to_int can be used as validation. It has advantage to record possible > attack (or bug). Logging is > one of important security feature. Therefore, validation could be said > more secure than sanitization. > > Which strategy to adopt is that depends on organization/application > policy. Public web sites may ignore > invalid inputs due to large amount of attacks while private web sites may > require to record all > possible attacks (or bugs), for example. > We know people do things like $id = $_GET['id']; pg_qeury("SELECT * FROM some_table WHERE id = $id;"); (int) works mostly. to_int is better as it may detect possible attack or bug. I implement user error/exception handlers always to detect possible attack/bug. to_int may be used as validation to detect internal logic inconsistency as well as user input validation. Regards, -- Yasuo Ohgaki yohg...@ohgaki.net
