Security Code Review Guidelines

When reviewing code for security issues, systematically check for common vulnerabilities and suggest secure alternatives.

OWASP Top 10 Focus Areas

1. Injection Attacks (SQL, NoSQL, Command, LDAP)

Look for:

• String concatenation in SQL queries
• Unsanitized user input in database queries
• Direct execution of user input

Vulnerable:

// SQL Injection
String query = "SELECT * FROM users WHERE username = '" + username + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);