search results page. Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design. As regards programs like Dropbox, add special parts that could be used to connect to online resources in an offline program. Utilize the Linux Dynamic Linker to define a function with the same name as certain libc functions, link that function as a library, and override the use of the libc function. Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example: What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason," or quotation marks as in "Bub 'Slugger' McCracken"). The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system. Another benign use of code injection could be the discovery of injection flaws themselves, with the intention of fixing these flaws. This is known as a white hat penetration test. Preventing problems To prevent code injection problems, utilize secure input and output handling, such as: Using APIs that, if used properly, are secure against all input characters. Parameterized queries (also known as "Compiled queries", "prepared statements", "bound variables") allows for moving user data out of string to be interpreted. Additionally Criteria API and similar APIs move away from the concept of command strings to be created and interpreted. Enforcing language separation via a static type system. Input validation, such as whitelisting only known good values, this can be done on client side using JavaScript for example or it can be done on the server side which is more secure. Input encoding, e.g. escaping dangerous characters. For instance, in PHP, using the htmlspecialchars() function to escape special characters for safe output of text in HTML, and mysqli::real_escape_string() to isolate data which will be included in an SQL request, to protect against SQL Injection. Output encoding, i.e. preventing HTML Injection (XSS) attacks against web site visitors HttpOnly is a flag for HTTP Cookies that, when set, does not allow client-side script interaction with cookies, thereby preventing certain XSS attacks. Modular shell disassociation from kernel With SQL Injection, one can use parameterized queries, stored