Practical software engineering foundations · Lesson 55 of 60 · Concept lesson · Optional

Security fundamentals

Authentication checks who you are, and authorization checks what you are allowed to do.

Encryption scrambles data so only someone with the key can read it, and passwords should be stored only as salted hashes, never as plain text.

Treat all input as untrusted: validate it, and never build commands or queries by pasting input into text.

Picture it

authentication  "Who are you?"
                (log in)

authorization   "May you do this?"
                (permissions)

Two different checks. Authentication proves who you are, and authorization decides what that person may do.

Code example

function escapeHtml(text) {
  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
}
console.log(escapeHtml("<script>alert(1)</script>"));

Output: <script>alert(1)</script>

Escaping turns special characters into harmless text, so pasted input cannot run as code on a page.

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE users (name TEXT)")
db.execute("INSERT INTO users VALUES ('Ada')")
name = "x' OR '1'='1"
rows = db.execute("SELECT * FROM users WHERE name = ?", (name,)).fetchall()
print(len(rows))

Output: 0

The ? placeholder keeps the input as data, so the attack text matches no user. Pasting it into the query text could have returned every row.

Check yourself

Pick an answer for each question. You can retry as many times as you like.

Loading the questions…