Apply Security Design Pattern to Defend Command Injection Attack | 4th | week 1 |.
Avoid using any dynamic system function code such as exec to perform system operation. And try to make it as specific as possible using specific API code such as mail, you do an email, or you are using mkdir to make directory. In those case, those specific API codes or parameters cannot be interpreted as generic open system command. For more detail, please read owasp injection prevention cheat sheet. Input validation is a fundamental techniques used to sanitize the data in any of the program. And we will make sure that within the range of a various or of certain type, maybe a string, maybe a number. And here we are using it for security purpose. And hard to detect whether they are malicious code pattern in the input.