Editing Defensive programming (section)

====The three rules of data security====
* All [[data]] is important until proven otherwise.
* All data is tainted until proven otherwise.
* All code is insecure until proven otherwise.
** You cannot prove the security of any code in [[userland (computing)|userland]], or, more commonly known as: ''"never trust the client"''.
These three rules about data security describe how to handle any data, internally or externally sourced:

'''All data is important until proven otherwise''' - means that all data must be verified as garbage before being destroyed.

'''All data is tainted until proven otherwise'''   - means that all data must be handled in a way that does not expose the rest of the runtime environment without verifying integrity.

'''All code is insecure until proven otherwise'''  - while a slight misnomer, does a good job reminding us to never assume our code is secure as bugs or [[undefined behavior]] may expose the project or system to attacks such as common [[SQL injection]] attacks.