Developer's Guide to Web Application Security

 Examine database queries and connections.

 Track use of network communications.

Pulling It All Together

 Use tools such as UNIX grep, GNU less, the DOS find command,

UltraEdit, or SourceEdit to look for the functions previously listed.

Q: This is tedious. Do any automated tools do this work?

A: Due to the custom and dynamic nature of source code, it’s very hard to design a

tool that is capable of understanding what the developer intended and how an

attacker might subvert that.Tools such as SourceEdit help highlight some problem

areas—but these tools are far from becoming an automated replacement.

Q: Will outside companies check our source code for ...