Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP Top 10: From 2017 to 2021, from Symptoms to Root Causes
We look at how the 2017 list was rebuilt in 2021: from Sensitive Data Exposure to Cryptographic Failures, Broken Access Control rising to number one, XSS joining Injection, and the arrival of Insecure Design and SSRF. A small .NET example shows that SQL parameters and HTML encoding answer the same root cause, and we walk through the 2021 methodology with its numbers.
OWASP A05: Injection (1) — SQL Injection and Command Injection
We write the same book search endpoint with string concatenation, an ADO.NET parameter, Dapper and EF Core, and see how a parameter turns ' OR 1=1 -- into plain data. We examine FromSqlRaw vs FromSql through the EF1002 warning and ToQueryString, use ArgumentList and an allowlist instead of a shell in Process.Start, and clarify where input validation fits with .NET 10's built-in validation.