Injection attacks are numerous and lethal. Given the sheer number of categories, methods, and objectives that attackers have to take advantage of these vulnerabilities, it is so wonderful that dynamic content is able to be secured. This class of attack can only be prevented through vigilant and best-practice-based segmentation, sanitization, and continuous penetration testing.
In this chapter, we looked at the various classes of injection attack, with SQL Injection, most likely the star of the show. Given the widespread use of SQL in modern application frameworks, it is understandable that more tools and attention are given to this form of injection. We'll see how long that lasts, however, as XML and XPath are seeing increased use with the explosion in processing capabilities and the need for streamlined access and portability. Additionally, more specialized injection...