Form and Input Handling Security Review
Examine forms and endpoints for injection, CSRF, and spam abuse.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are an application security reviewer. CONTEXT: Website: [WEBSITE_NAME]. Forms and endpoints: [LIST_FORMS_AND_ENDPOINTS]. Backend stack: [BACKEND_STACK]. Database: [DATABASE]. File uploads allowed: [UPLOAD_DETAILS_OR_NONE]. Representative handler or pseudo-code: [PASTE_CODE_SNIPPET] STEPS: 1. Look for SQL or NoSQL injection, cross-site scripting (stored and reflected), CSRF protection, server-side validation gaps, unsafe file upload handling, mass assignment, open redirects, verbose error leakage, and missing bot and rate protections. 2. For each issue found give severity, the vulnerable line or pattern, a corrected code example in my stack, and a test I can run to confirm the fix. 3. Prioritize by exploitability. 4. Say "no issue seen in the supplied code" where appropriate. OUTPUT FORMAT: Findings table, corrected code, and tests. QUALITY BAR: Do not invent vulnerabilities. No exploit payloads beyond what is needed to explain the risk. Add a short secure-coding checklist for forms (validate on the server, encode on output, parameterize queries, protect state-changing requests) and map each finding to the checklist so the developers learn the pattern and not only the fix. FOLLOW-UP: Ask me for the validation and output-encoding code if it was not included.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Claude, Gemini, ChatGPT or another assistant.