I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?


I wouldn't say it is necessary to know how to hack a website, but I would say it is necessary to know how to defend one. This may sound like the same thing but they really are different. There are multiple ways to attack a website (SQL injections, cross site scripting attacks, email header injections) and how you would do this can vary depending on what the attacker is hoping to accomplish (steal information, hijack a session, phishing). Defending against these doesn't require knowing how this is done as they can get quite complicated. All you need to know is how to code defensively to stop this attacks from being useful.

For example, you should always escape special characters when doing a SQL query to prevent SQL injections. You don't have to know how a SQL injection is done. You just have to know that escaping your query properly will prevent these attacks from being successful.

Cross site scripting attacks can be very complicated to perform. But as long as know how to defend against them (use HTTPS for logins, change session IDs when a user logs in, filter user input to avoid HTML code injection, http only cookies, etc) you can present them from being successful.

Knowing how these attacks are performed does make it easier for you to understand how to defend against them. But it is not required to know how these attacks work in detail. A very basic understanding of the concept, along with a strong knowledge of how to defend against them, is enough to ensure you keep your websites safe.

  • @ John Code | Does it means that the website that has no "User Input Application etc." is safe from the attack?If your website doesn't have application that requires user interaction is it safe already? is it possible that i might be hacked?
    – adietan63
    Jun 26 '11 at 14:55
  • @adietan63 Not necessarily. You may build your site where some pages do accept parameters and they can be misused (for example, a picture gallery and the links "first page", "previous page", "next page" etc -- if you do not filter/escape such script parameter properly you may get into trouble -- SQL Injection, for example). Everything that come from "the other side" (user browser) needs to be validated/escaped -- you should NEVER trust such data.
    – LazyOne
    Jun 26 '11 at 15:02
  • @adietan63, Unfortunately it's not that simple. Attacks can happen by placing malicious code in the URL of your web pages. Framing your website also allows for your site to be attacked as users may not know that they aren't really on your site. Then they can be fooled into giving away sensitive information. So even basic websites need to keep security in mind.
    – John Conde
    Jun 26 '11 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.