Security should be built into code from the start.
Input Validation
- Never trust user input
- Validate on server-side
- Use parameterized queries
- Sanitize outputAuthentication
- Hash passwords with bcrypt
- Implement account lockout
- Use secure sessionsWatch for: SQL injection, XSS, CSRF.