#secure coding review Secure Coding Review Choose a programming language and application. Review the code for security vulnerabilities and provide recommendations for secure coding practices. Use tools like static code analyzers or manual code review.

a sample Flask application

[1] from flask import Flask, request, render_template_string import sqlite3

app = Flask(name)

@app.route('/') def index(): return "Welcome to the Secure Coding Review!"

@app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] conn = sqlite3.connect('example.db') cursor = conn.cursor() cursor.execute(f"SELECT * FROM users WHERE username='{username}' AND password='{password}'") user = cursor.fetchone() conn.close() if user: return "Login successful!" else: return "Login failed!" return '''

Username:
Password:
'''

@app.route('/greet') def greet(): name = request.args.get('name', 'Guest') template = "

Hello, {{ name }}!

" return render_template_string(template, name=name)

if name == 'main': app.run(debug=True)

• Serving Flask app 'main'
• Debug mode: on INFO:werkzeug:WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
• Running on http://127.0.0.1:5000 INFO:werkzeug:Press CTRL+C to quit INFO:werkzeug: * Restarting with stat Double-click (or enter) to edit

Manual Code Review and Security Vulnerabilities

1.SQL Injection

2.Cross-Site Scripting (XSS)

3.Sensitive Data Exposure

4.Debug Mode Enabled:

Recommendations for Secure Coding Practice

1.Prevent SQL Injection

[ ] cursor.execute("SELECT * FROM users WHERE username=? AND password=?", (username, password))

2.Prevent Cross-Site Scripting (XSS):

[ ] from markupsafe import escape

@app.route('/greet') def greet(): name = request.args.get('name', 'Guest') template = "

Hello, {{ name }}!

" return render_template_string(template, name=escape(name)) 3 Hash Passwords:

[ ] from werkzeug.security import generate_password_hash, check_password_hash

To store a new user password

hashed_password = generate_password_hash(password)

To check a password during login

cursor.execute("SELECT password FROM users WHERE username=?", (username,)) stored_password = cursor.fetchone() if stored_password and check_password_hash(stored_password[0], password): return "Login successful!"