To minimise the cyber security concerns, we have to rely more on HI i.e. human intelligence, rather than on AI i.e. Artificial intelligence.

Because at the end of the day, the programmer behind the development of the system or application is responsible for cyber threats.

Lets take a few examples to better understand how cyber security is related to bad code practices

(for now just focus on concept, we'll understand the technicality later on in this course.)

Example - 1

SELECT * FROM users WHERE username = '$username' AND password = '$password'

This code is vulnerable to SQL injection attacks because it concatenates user-supplied data directly into the SQL query. An attacker could input malicious data into the username and password fields, causing the query to execute unintended actions on the database.

How to solve it:

By use of prepared statements with parameterized queries to ensure that user-supplied data is properly sanitized and cannot be used to inject SQL commands.

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);
$user = $stmt->fetch();

This code uses a prepared statement with named parameters to separate the SQL command from the user-supplied data. This ensures that the query is executed as intended and prevents SQL injection attacks.

Example - 2

import os

filename = input('Enter the filename: ')
os.system('rm ' + filename)

This code is vulnerable to command injection attacks because it passes user-supplied input directly to the os.system() function without any validation or sanitization. An attacker could input malicious data into the filename field, causing unintended commands to be executed on the system.

How to solve it: By using the subprocess module to execute shell commands and pass arguments as a list instead of a string like below

import subprocess

filename = input('Enter the filename: ')
subprocess.call(['rm', filename])

This code uses the subprocess.call() function to execute the rm command and passes the filename argument as a list item. This ensures that any special characters or malicious input in the filename are properly escaped and prevents command injection attacks.

By the above examples you get the feel of how small the flaw could be and how big a impact can cyber security have. That's why we'll learn basics of cyber security in this course.