Page Comparison

1. Every access to backend systems such as databases MUST be parameterized^[1], e.g. via prepared statements, OR mappers (e.g. Hibernate) when an API for this matter does exist.

2. All parameters, either internally or user-controlled, MUST be declared as parameters within a prepared statement (or similar API) call.

3. In case an API does not provide any methods for parameterized statements, parameters MUST be encoded with suitable APIs (e.g. SQL encoding) to prevent interpreter injection.

4. User-controlled parameters MUST be encoded with a suitable API and method related to its output context if written to an HTML pageinto a webpage:

   1. HTML Contextcontext: HTML entity encoding

   2. JavaScript Contextcontext: JavaScript escaping

   3. CSS Contextcontext: CSS escaping

5. Output encoding SHOULD only be implemented with mature APIs and frameworks.

6. Implicit validation (e.g. via ORM frameworks or template technologies) SHOULD be preferred to explicit validation (API calls).

...