Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?

share|improve this question

I wouldn't say it is necessary to know how to hack a website, but I would say it is necessary to know how to defend one. This may sound like the same thing but they really are different. There are multiple ways to attack a website (SQL injections, cross site scripting attacks, email header injections) and how you would do this can vary depending on what the attacker is hoping to accomplish (steal information, hijack a session, phishing). Defending against these doesn't require knowing how this is done as they can get quite complicated. All you need to know is how to code defensively to stop this attacks from being useful.

For example, you should always escape special characters when doing a SQL query to prevent SQL injections. You don't have to know how a SQL injection is done. You just have to know that escaping your query properly will prevent these attacks from being successful.

Cross site scripting attacks can be very complicated to perform. But as long as know how to defend against them (use HTTPS for logins, change session IDs when a user logs in, filter user input to avoid HTML code injection, http only cookies, etc) you can present them from being successful.

Knowing how these attacks are performed does make it easier for you to understand how to defend against them. But it is not required to know how these attacks work in detail. A very basic understanding of the concept, along with a strong knowledge of how to defend against them, is enough to ensure you keep your websites safe.

share|improve this answer
@ John Code | Does it means that the website that has no "User Input Application etc." is safe from the attack?If your website doesn't have application that requires user interaction is it safe already? is it possible that i might be hacked? – adietan63 Jun 26 '11 at 14:55
@adietan63 Not necessarily. You may build your site where some pages do accept parameters and they can be misused (for example, a picture gallery and the links "first page", "previous page", "next page" etc -- if you do not filter/escape such script parameter properly you may get into trouble -- SQL Injection, for example). Everything that come from "the other side" (user browser) needs to be validated/escaped -- you should NEVER trust such data. – LazyOne Jun 26 '11 at 15:02
@adietan63, Unfortunately it's not that simple. Attacks can happen by placing malicious code in the URL of your web pages. Framing your website also allows for your site to be attacked as users may not know that they aren't really on your site. Then they can be fooled into giving away sensitive information. So even basic websites need to keep security in mind. – John Conde Jun 26 '11 at 15:05
Thanks man for the answer : ) – adietan63 Jun 26 '11 at 15:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.