---
# System prepended metadata

title: Writeup

---

# Writeup

## SQL Injection Recommendation

We recommend using parameterized SQL queries in which placeholders are used for parameters and the parameter values are supplied at execution time. This allows the server to handle placing parameters in an SQL query, while preventing users from excuting SQL queries that are passed in as parameters. Server will automatically handle escaping data. Additionally, parameterized queries are typically faster because the server can cache the query plan.

## XSS Scripting Recommendation

We recommend using Content Security Policy (CSP) as a HTTP response header that browsers can use to enhance the security of the document (or web page). This allows the server to restrict how resources such as JavaScript, CSS, or other things that the browser loads. CSP will prevent any scripts inserted into the search query from executing.

## CSRF Recommendation

We recommend using Referer and Origin Headers so that it will only send POST requests from a valid origin and not from an attacker site. For a more robust option, you can use Fetch Metadata so that the server has more information about where the requests are being sent from to prevent attacker sites from getting responses from POST requests.

## Did you like the PA? Anything that could be improved? Give your suggestions here

Yes, the PA was mostly enjoyable, with a few tricky things that we got stuck on. The SQL Injection part in particular was slightly hard to understand what was going on underneath these attacks.

## Resources

- Piazza Posts
- Discussion
- https://stackoverflow.com/questions/8981009/can-you-create-a-javascript-string-without-using-or-quotes
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
