Cyber security has become an essential part of the digital world due to the rise in malicious attackers. Cyber security ensures to the protection of data, and systems from cyber attacks like Denial of Service attacks, Ransomware attacks, Virus attacks, etc. These attacks are possible by finding vulnerabilities in the system, network, or any software. Different types of vulnerabilities can be found in any software or system if proper security measures were not taken so we will compare the two most common vulnerabilities which are XSS and SQL Injection to understand the problem and their mitigation.

What is Cross-site Scripting(XSS)?

XSS (Cross-site scripting) can be understood as a web vulnerability that allows attackers to insert malicious JavaScript code into webpages of a vulnerable website. Once the client-side scripts are injected then the attacker can do many unethical tasks like stealing cookies, changing default settings, showing different types of popups, etc. With an XSS attack, an attacker can change the content of the website to defame it or redirect users to other websites.

Mitigation Techniques

• Each and every developer must be aware of the XSS attacks and proper training should be given before doing development work.
• Only allow trusted users’ input and set permissions for any external input through HTML.
• Use escaping libraries for using user’s input like CSS escape, URL escape, HTML escape, etc.
• To prevent cookie stealing, set the HttpOnly flag.
• Use a security scanner on regular basis for checking any new vulnerabilities.

What is SQL Injection?

SQL Injection can be understood as an attacking technique that uses SQL statements to interact with the database and make it behave abnormally. SQL statements can be injected using various fields like URLs, HTML form fields, cookies, etc. An attacker can insert malicious statements into input fields of a login form to query a database, if injected successfully then it can result in the compromise of the complete database with all the sensitive information like usernames, passwords, etc.

Mitigation Techniques

•  Sanitize user input using an extra layer and check against common SQL syntax.
• Instead of raw data input, use dropdowns or checklists for input and set input character limit.
• Try to use parameterized statements and stored procedures whenever possible.
• Scan and update applications at regular intervals.
• Always use a firewall especially a web application firewall to make websites and web applications less vulnerable.

Following is a table of differences between XSS and SQL Injection:

Conclusion/Summary

In the above comparison, we found that both vulnerabilities are of high risk if found in any website or web application. It can lead to the compromise of users’ data along with sensitive information like bank accounts or health information. Hence developers must have knowledge of these vulnerabilities and implement the techniques to mitigate the attacks.