MySQL and Perl for the Web

Channels of Information

Web applications involve the flow and storage of information, and the goal of security is to protect that information so that it can’t be seen or modified except by the appropriate parties. For a typical database-backed Web application, information travels through several conduits, all of which are points of attack that are subject to inspection or subversion. Opportunities for compromise present themselves in many ways:

• One information channel goes over the network between the Web server and the clients that access it. Potential insecurities include having the connection wiretapped by a third party or having the client himself submit false information or excessive amounts of information in an attempt to mislead or overwhelm ...