Now that's it for this course section.
We had a look at a couple of attack patterns,
and a couple of vulnerabilities,
and I did show you how these attacks work
and how you can protect against them.
The key takeaways you should have from this section
is that you should never trust your users
and especially not their input.
You should sanitize or clean that input
before you process or store it,
or you should escape it.
You should definitely only output escaped content
unless you have a strong reason for doing the opposite.
And then, sanitizing is an extra step
you could do instead of escaping,
if you need to output raw content for whatever reason.
But, you should always be careful
when working with user input
and you should use third party libraries.
As I showed it to you throughout the discourse section,
to work with such input
when it comes to rendering it on a page
or when it comes to putting it into your SQL statements.
regarding CSRF attacks,
you should make sure that you add such a CSRF token into all
your forms on your page.
This token, as you learned,
can be generated by third party packages.
And it's only known to your server.
It's only valid for one request response cycle,
and it can't be guessed by our pages.
The offer including such a token in all your forms and
ensures that no requests to your server can be sent from
faked sites that might look like your site,
and that's therefor also something you should keep in
mind, and something you will see in that main project,
which we're going to build in a couple of sections,
but with that, that's it for security,
when it comes to user input and dealing with user input now
to really round up this section,
I got two other aspects you should be aware of.