<p>I am looking for easy steps that are simple and effective in making a web application more secure.</p>

<p>What are your top tips for secure web applications, and what kind of attack will they stop?</p>

[{'answer_id': 47324, 'author': 'Oded', 'author_id': 1583, 'author_profile': 'https://Stackoverflow.com/users/1583', 'pm_score': 2, 'selected': False, 'text': '<ol>\n<li>Escape user provided content to avoid <a href="http://ha.ckers.org/xss.html" rel="nofollow noreferrer">XSS</a> attacks.</li>\n<li>Using <a href="http://www.unixwiz.net/techtips/sql-injection.html" rel="nofollow noreferrer">paremeterised SQL</a> or stored procedures to avoid <a href="https://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/" rel="nofollow noreferrer">SQL Injections</a> attacks.</li>\n<li>Running the webserver as an unprivileged account to minimise attacks on the OS.</li>\n<li>Setting the webserver directories to an unprivileged account, again, to minimise attacks on the OS.</li>\n<li>Setting up unprivileged accounts on the SQL server and using them for the application to minimise attacks on the DB.</li>\n</ol>\n\n<p>For more in depth information, there is always the <a href="http://www.owasp.org/index.php/OWASP_Guide_Project" rel="nofollow noreferrer">OWASP Guide to Building Secure Web Applications and Web Services</a></p>\n'}, {'answer_id': 47325, 'author': 'Espo', 'author_id': 2257, 'author_profile': 'https://Stackoverflow.com/users/2257', 'pm_score': 4, 'selected': True, 'text': '<p>Microsoft Technet has en excellent article:</p>\n\n<p><a href="http://technet.microsoft.com/en-us/library/cc512638.aspx" rel="nofollow noreferrer">Ten Tips for Designing, Building, and Deploying More Secure Web Applications</a></p>\n\n<p>Here are the topics for the tips answered in that article:</p>\n\n<ol>\n<li>Never Directly Trust User Input</li>\n<li>Services Should Have Neither System nor Administrator Access</li>\n<li>Follow SQL Server Best Practices</li>\n<li>Protect the Assets</li>\n<li>Include Auditing, Logging, and Reporting Features</li>\n<li>Analyze the Source Code</li>\n<li>Deploy Components Using Defense in Depth</li>\n<li>Turn Off In-Depth Error Messages for End Users</li>\n<li>Know the <a href="http://technet.microsoft.com/nb-no/library/cc722488(en-us).aspx" rel="nofollow noreferrer">10 Laws of Security Administration</a></li>\n<li>Have a Security Incident Response Plan</li>\n</ol>\n'}, {'answer_id': 47331, 'author': 'Andy Rose', 'author_id': 1762, 'author_profile': 'https://Stackoverflow.com/users/1762', 'pm_score': 3, 'selected': False, 'text': '<p><strong>Do not trust user input.</strong></p>\n\n<p>Validation of expected data types and formatting is essential to avaoiding SQL injection and  Cross-Site Scripting (XSS) attacks.</p>\n'}, {'answer_id': 47469, 'author': 'Purfideas', 'author_id': 4615, 'author_profile': 'https://Stackoverflow.com/users/4615', 'pm_score': 0, 'selected': False, 'text': '<p>Set the secure flag on cookies for SSL applications.  Otherwise there is always a highjacking attack that is <em>much</em> easier to conduct than breaking the crypto.  This is the essence of CVE-2002-1152.</p>\n'}, {'answer_id': 47581, 'author': 'Andrew Whitehouse', 'author_id': 4890, 'author_profile': 'https://Stackoverflow.com/users/4890', 'pm_score': 1, 'selected': False, 'text': '<p>Some of my favourites:</p>\n\n<ol>\n<li><a href="http://shiflett.org/blog/2005/feb/my-top-two-php-security-practices" rel="nofollow noreferrer">Filter Input, Escape Output</a> to help guard against XSS or SQL injection attacks</li>\n<li>Use prepared statements for database queries (SQL injection attacks)</li>\n<li>Disable unused user accounts on your server to prevent brute force password attacks</li>\n<li>Remove Apache version info from HTTP header (ServerSignature=Off, ServerTokens=ProductOnly)</li>\n<li>Run your web server in a chroot jail to limit damage if compromised</li>\n</ol>\n'}, {'answer_id': 68820, 'author': 'Markc', 'author_id': 8609, 'author_profile': 'https://Stackoverflow.com/users/8609', 'pm_score': 1, 'selected': False, 'text': '<p><a href="http://www.owasp.org" rel="nofollow noreferrer">OWASP</a> is your friend.  Their <a href="http://www.owasp.org/index.php/Top_10_2007" rel="nofollow noreferrer">Top Ten List</a> of web application security vulnerabilities includes a description of each problem and how to defend against it. The site is a good resource for learning more about web application security and is a wealth of tools and and testing techniques as well.</p>\n'}]
['https://Stackoverflow.com/questions/47323', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1583/']