--- title: The 3 Laws of Writing Unhackable Code | daily.dev description: Three common web vulnerabilities are explained through simple code examples: path traversal from unsanitized file paths, code injection via eval() on user... canonical: https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The 3 Laws of Writing Unhackable Code | daily.dev og:description: Three common web vulnerabilities are explained through simple code examples: path traversal from unsanitized file paths, code injection via eval() on user... og:url: https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn og:image: https://api.daily.dev/og/posts/6RXu0p3Mn.png og:image:alt: The 3 Laws of Writing Unhackable Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The 3 Laws of Writing Unhackable Code **[Kantan Coding](https://daily.dev/sources/kantancoding)** · 4 min read · 5 upvotes · 0 comments ## Summary Three common web vulnerabilities are explained through simple code examples: path traversal from unsanitized file paths, code injection via eval() on user input, and SQL injection from string concatenation in queries. The fixes proposed are resolving and validating canonical paths against a safe directory, avoiding eval by using safer parsing libraries, and using parameterized queries with placeholders instead of concatenating SQL strings. The overarching principle offered is to never trust user input and to always separate data from instructions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent path traversal attacks when serving files based on a user-supplied filename? Resolve the requested path to its canonical absolute form, evaluating any symlinks, then verify that the resolved path still starts with the intended safe base directory before serving the file. If it does not, deny access. This prevents attackers from using sequences like ../ in the filename to escape the designated directory and read arbitrary files, such as a system password file. _Developers hardening file-serving code can find more secure coding breakdowns like this on daily.dev._ ### Why is using eval() on user input a security vulnerability? Using eval() on user input is dangerous because it makes attacker-supplied data directly executable: the function parses the input as code and runs it at runtime, letting a bad actor execute arbitrary logic on the server. The fix is to replace eval with a production-ready parsing library built specifically to evaluate expressions safely without executing arbitrary code. _daily.dev surfaces practical writeups like this for developers avoiding unsafe eval patterns._ ### How do parameterized queries prevent SQL injection? Parameterized queries prevent SQL injection by passing user-provided data as separate arguments through placeholders instead of concatenating it directly into the SQL string. This forces the database driver to treat the input strictly as data values rather than executable SQL, neutralizing attacks like a password field containing input that makes a condition always true. _For developers defending login and query code against injection, daily.dev collects examples like this one._ ## Similar posts on daily.dev - [Top 10 Vulnerabilities Found in Secure Code Review](https://daily.dev/posts/top-10-vulnerabilities-found-in-secure-code-review-ckwrjxfex) · Security Boulevard · 0 upvotes · 0 comments - [SQL Injection: Why It Persists and How to Prevent It](https://daily.dev/posts/sql-injection-why-it-persists-and-how-to-prevent-it-a5i6fyqpz) · Latest Hacking News · 0 upvotes · 0 comments - [Secure coding in JavaScript](https://daily.dev/posts/secure-coding-in-javascript-ih44s1aff) · Stack Overflow Blog · 5 upvotes · 0 comments - [How to Fix Common Web Application Security Vulnerabilities in Node.js](https://daily.dev/posts/how-to-fix-common-web-application-security-vulnerabilities-in-node-js-nhhyrhesv) · freeCodeCamp · 3 upvotes · 0 comments --- Tags: [#appsec](https://daily.dev/tags/appsec), [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql) [View this post on daily.dev](https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The 3 Laws of Writing Unhackable Code","url":"https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn"},"datePublished":"2026-08-18T15:29:12.802Z","dateModified":"2026-10-15T02:22:37.036Z","description":"Three common web vulnerabilities are explained through simple code examples: path traversal from unsanitized file paths, code injection via eval() on user...","image":"https://i.ytimg.com/vi/QN7svuxtc6U/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/QN7svuxtc6U/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Kantan Coding","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Kantan Coding","logo":"https://media.daily.dev/image/upload/s--FBdOHLfr--/f_auto/v1729363355/logos/kantancoding","url":"https://daily.dev/sources/kantancoding"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"appsec,security,sql","timeRequired":"PT4M","video":{"@type":"VideoObject","name":"The 3 Laws of Writing Unhackable Code","description":"Three common web vulnerabilities are explained through simple code examples: path traversal from unsanitized file paths, code injection via eval() on user...","thumbnailUrl":"https://i.ytimg.com/vi/QN7svuxtc6U/sddefault.jpg","uploadDate":"2026-08-18T15:29:12.802Z","duration":"PT4M","url":"https://api.daily.dev/r/6RXu0p3Mn","embedUrl":"https://www.youtube.com/embed/QN7svuxtc6U"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Kantan Coding","item":"https://daily.dev/sources/kantancoding"},{"@type":"ListItem","position":3,"name":"The 3 Laws of Writing Unhackable Code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-3-laws-of-writing-unhackable-code-6rxu0p3mn#faq","mainEntity":[{"@type":"Question","name":"How do I prevent path traversal attacks when serving files based on a user-supplied filename?","acceptedAnswer":{"@type":"Answer","text":"Resolve the requested path to its canonical absolute form, evaluating any symlinks, then verify that the resolved path still starts with the intended safe base directory before serving the file. If it does not, deny access. This prevents attackers from using sequences like ../ in the filename to escape the designated directory and read arbitrary files, such as a system password file. Developers hardening file-serving code can find more secure coding breakdowns like this on daily.dev."}},{"@type":"Question","name":"Why is using eval() on user input a security vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Using eval() on user input is dangerous because it makes attacker-supplied data directly executable: the function parses the input as code and runs it at runtime, letting a bad actor execute arbitrary logic on the server. The fix is to replace eval with a production-ready parsing library built specifically to evaluate expressions safely without executing arbitrary code. daily.dev surfaces practical writeups like this for developers avoiding unsafe eval patterns."}},{"@type":"Question","name":"How do parameterized queries prevent SQL injection?","acceptedAnswer":{"@type":"Answer","text":"Parameterized queries prevent SQL injection by passing user-provided data as separate arguments through placeholders instead of concatenating it directly into the SQL string. This forces the database driver to treat the input strictly as data values rather than executable SQL, neutralizing attacks like a password field containing input that makes a condition always true. For developers defending login and query code against injection, daily.dev collects examples like this one."}}]} ```