From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Unlock this course with a free trial

Join today to access over 24,000 courses taught by industry experts.

Output encoding

Output encoding

From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Start my 1-month free trial Buy for my team

Output encoding

“

- [Instructor] Output encoding is an important technique used to protect applications against potentially malicious input such as that used in SQL injection and cross site scripting attacks. The basic premise of output encoding is to take a potentially dangerous character and replace it with an equivalent string that produces the same result for the end user, but doesn't have the risk of maliciously manipulating the application. We can use two different types of encoding. HTML encoding uses an ampersand notation and it's used for encoding values in a web document. URL encoding uses a percent sign notation and it's used for encoding values in a web address. There are some very common values that we output in code. The less than symbol used in HTML tag-based attacks such as cross-site scripting is HTML encoded as < and it's URL encoded as %3c. While the greater than symbol is HTML encoded as > and URL encoded as %3e. The single quotation mark used in SQL injection and related…

Contents