

closed as too broad by Anders, Xander, CaffeineAddiction, Steffen Ullrich, Rory Alsop May 11 '17 at 21:01


  • 4
  • This question is way to broad. – Little Code May 10 '17 at 7:37



At a minimum:

  2. SQL Injection protection.



If you take inputs from a user please validate that input and also ensure that the web server runs with least privileges. Also check the OWASP top 10, and these links which will help you:


I work in the IT Security profession as an IT auditor. In your case, you would need to protect both the information at rest while stored in the database and during transit, while the data is being written to the database from the application. In addition, you need to defend against common attacks against web applications.

Protecting data in transit

Following the confidentiality principle of the security triad, you would want to encrypt the data to protect against MITM attacks. Be sure to use a strong encryption method such as TLS version 1.2 with AES encryption algorithm and key length of at least 128.

Protecting data at rest

Data, depending on the classification or value should also be encrpyted at rest while stored in the database. If there are credentials stored in the database, such credentials should be hashed using a strong hashing algorithm. Do not use SHA 1 because its insecure.

Defending against attacks aimed at web applications

In addition to protecting data in transit and at rest, you also need to defend against common web-based attacks such as

SQL injection, XSS, cross site request forgery (CSRF / session riding), and attacks on sessions like fixation.

The main defense for SQL injection and XSS attacks is validation of user input on your site through escaping of dangerous input (ex: SELECT * FROM) and use of parameterized functions. For session fixation attacks, the main defense is disallowing session IDs in POST statements and regenerating the session ID upon each request from the client. For CSRF, the main protection is using additional data in the client authentication request that allows the server to detect and deny requests coming from outside the established session.
