Web Security And You
summary
Covers concrete vulnerabilities: XSS, CSRF, session hijacking, SQL injection, command and file‑upload injection, and weak hashes. Shows fixes like PDO prepared statements instead of string SQL, ditching MD5 for PHP 5.5+ password_hash with per‑user salts, generating per‑form CSRF tokens stored in session, regenerating sessions with session_regenerate_id(true), using recaptcha and IP rate limiting to blunt brute force, and preventing clickjacking via the X-Frame-Options header or frame‑busting fallback.
AI-written summary · about
chapters (23)
- 0:00Start
- 1:12Security? Bah!
- 3:18Unchecked Permissions
- 6:10Information leaks
- 7:42Low Security Hashes (Encryption)
- 10:55SQL Injection
- 15:10Other Injection
- 18:01Session Hijacking
- 22:24Session Fixation (Take 2)
- 25:17Session Anti-Hijack Measures
- 28:39XSS (Cross Site Scripting)
- 30:47XSS - Reflected XSS
- 35:57XSS - Stored XSS
- 37:46XSS - DOM XSS
- 41:06CSRF (Cross Site Request Forgery)
- 50:12Clickjacking - Solution 1
- 52:04Clickjacking - Solution 2
- 54:13Brute Force Attacks (Password)
- 54:37Brute Force Attacks (CAPTCHA)
- 56:09Brute Force Attacks (Rate Limit)
- 57:49Keep Your Stack Patched
- 58:37DDOS & Similar Attacks
- 59:08Man in the Middle
related talks
55mWeb Application Security: Winning When The Odds Are Against You
10mIntroduction to web security
30mWeb Security Engineering - Protect all layers of your project
19mFrontend Security is a Thing
59mPractical Security for Web Applications
22mWeb development security fundamentals
02h 14mWeb application security (Part 1)
52mPractical Security in Web Applications