{"id":2422,"date":"2021-06-17T11:05:37","date_gmt":"2021-06-17T16:05:37","guid":{"rendered":"https:\/\/xlinesoft.com\/blog\/?p=2422"},"modified":"2026-08-12T17:02:58","modified_gmt":"2026-08-12T22:02:58","slug":"secure-low-code-web-applications","status":"publish","type":"post","link":"https:\/\/xlinesoft.com\/blog\/2021\/06\/17\/secure-low-code-web-applications\/","title":{"rendered":"Building secure low-code web applications"},"content":{"rendered":"<p><em>Updated August 2026.<\/em><\/p>\n<p>Low-code tools can handle much of the repetitive work involved in building secure web applications, but deployment and configuration still matter. Applications created by <a href=\"https:\/\/xlinesoft.com\/phprunner\/index.htm\">PHPRunner<\/a> and <a href=\"https:\/\/xlinesoft.com\/asprunnernet\">ASPRunner.NET<\/a> include built-in protections against common web application vulnerabilities such as SQL injection, XSS, and CSRF. For an overview of the most common web application security risks, see the <a href=\"https:\/\/owasp.org\/Top10\/\">OWASP Top 10<\/a>.<\/p>\n<p>In this article, we focus on additional security measures that are not directly related to generated application code but are still important when deploying a public web application. Use this checklist as a starting point and adapt it to your hosting environment, data sensitivity, and security requirements. <\/p>\n<p><a href=\"https:\/\/xlinesoft.com\/blog\/wp-content\/uploads\/2021\/06\/Fotolia_59066357_M.jpg\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/xlinesoft.com\/blog\/wp-content\/uploads\/2021\/06\/Fotolia_59066357_M-600x386.jpg\" alt=\"\" width=\"600\" height=\"386\" class=\"alignnone size-medium wp-image-2444\" srcset=\"https:\/\/xlinesoft.com\/blog\/wp-content\/uploads\/2021\/06\/Fotolia_59066357_M-600x386.jpg 600w, https:\/\/xlinesoft.com\/blog\/wp-content\/uploads\/2021\/06\/Fotolia_59066357_M-768x493.jpg 768w, https:\/\/xlinesoft.com\/blog\/wp-content\/uploads\/2021\/06\/Fotolia_59066357_M.jpg 800w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><br \/>\n<!--more--><\/p>\n<h3>1. Location of file-based database<\/h3>\n<p>If you use a file-based database such as Microsoft Access, make sure the database file is not directly accessible from the internet. The best option is to place it outside the website root folder. Otherwise, an attacker may be able to guess the location and name of the database file and download it. <\/p>\n<h3>2. Location of uploaded files folder<\/h3>\n<p>The same principle applies to uploaded files. When possible, store uploads in a folder that is not directly accessible from the internet. In PHPRunner and ASPRunner.NET, use the <strong>Absolute path<\/strong> option when specifying the upload folder.<\/p>\n<p>If you must use an upload folder that is accessible via HTTP, make sure scripts cannot be executed from that folder. For IIS, create a web.config file with the following content:<\/p>\n<div class=\"my-syntax-highlighter\">\n<pre><textarea id=\"mshighlighter\" class=\"mshighlighter\" language=\"\" name=\"mshighlighter\" >\r\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<configuration>\r\n    <system.webServer>\r\n        <handlers accessPolicy=\"Read\" \/>\r\n    <\/system.webServer>\r\n<\/configuration><\/textarea><\/pre>\n<\/div>\n<p>For Apache-based hosting, configure the upload directory so that uploaded files are served as files and cannot be executed as scripts. The exact directive depends on your Apache\/PHP configuration. For example:<\/p>\n<div class=\"my-syntax-highlighter\">\n<pre><textarea id=\"mshighlighter\" class=\"mshighlighter\" language=\"\" name=\"mshighlighter\" >\r\n<Directory \"C:\/xampp\/htdocs\/(path_to_directory)\/dirname\">\r\n    SetHandler default-handler\r\n    Options None\r\n    AllowOverride None\r\n<\/Directory><\/textarea><\/pre>\n<\/div>\n<h3>3. Use HTTPS<\/h3>\n<p>Use HTTPS for all public-facing applications so credentials and application data are encrypted in transit. Free TLS certificates are available from services such as <a href=\"https:\/\/letsencrypt.org\/\">Let&#8217;s Encrypt<\/a>.<\/p>\n<h3>4. Keep server software supported and up to date<\/h3>\n<p>If you run your own web server, keep the operating system and server software on supported, patched versions. This is especially important for public-facing components such as IIS, Apache, PHP, ASP.NET, database servers, and any other software exposed to the internet. <\/p>\n<h3>5. Password hashing<\/h3>\n<p>Never store user passwords as plain text. Enable password hashing and use BCRYPT when possible. In PHPRunner, the <strong>Encrypt passwords<\/strong> option supports BCRYPT. If the user database is compromised, properly hashed passwords are significantly harder for an attacker to recover and reuse. <\/p>\n<h3>6. Enable two-factor authentication<\/h3>\n<p>Two-factor authentication adds an important extra layer of protection for applications that store sensitive data or provide access to important business systems. PHPRunner and ASPRunner.NET support 2FA via SMS, email, and TOTP authenticator apps such as Google Authenticator and Microsoft Authenticator. Enable 2FA where appropriate and encourage users to use it. <\/p>\n<h3>7. Data encryption<\/h3>\n<p>Encrypt sensitive data in the database like social security numbers, addresses, birth dates, etc. If hackers ever get access to the database they won&#8217;t be able to see the encrypted data, unless they also have access to the encryption key. <\/p>\n<p>Data Encryption is available in PHPRunner Enterprise and ASPRunner.NET Enterprise. <\/p>\n<h3>8. Properly configure access permissions in the software<\/h3>\n<p>Broken access control remains one of the most important web application security risks. Make sure each user and user group can access only the pages, records, and operations they are authorized to use. In PHPRunner and ASPRunner.NET, use <strong>User Group Permissions<\/strong> and <strong>Advanced Security<\/strong> options such as &#8220;Users can see and edit their own data only&#8221;. <\/p>\n<p>Enable <strong>Advanced Security<\/strong> for all tables that end users can access. For instance, if you use master-details relationships, make sure the appropriate security rules are applied to both master and details tables. <\/p>\n<h3>9. Turn off detailed error messages<\/h3>\n<p>Detailed error messages can reveal useful information to an attacker, including file names, paths, table names, field names, and implementation details. Disable detailed error output in production through IIS settings for ASPRunner.NET or PHP settings for PHPRunner, and configure the application to display a generic error message to end users. <\/p>\n<h3>10. Restrict network access to your database<\/h3>\n<p>Your database should be reachable only from systems that actually need access, such as the web\/application server and authorized administration or development systems. Use firewall rules, private networking, or database access controls to prevent unnecessary public access.<\/p>\n<p>For development, avoid exposing a production database directly to the internet. Use a local or otherwise properly secured development environment whenever possible. <\/p>\n<h3>11. Prevent SQL injection in your own code<\/h3>\n<p>PHPRunner and ASPRunner.NET generate database-access code designed to protect against SQL injection, but you also need to handle values safely in any custom SQL you add to events. Use the <a href=\"https:\/\/xlinesoft.com\/phprunner\/docs\/db_preparesql.htm\">DB::PrepareSQL()<\/a> function when building custom SQL with variable values.<\/p>\n<p>For a more detailed explanation, see <a href=\"https:\/\/xlinesoft.com\/blog\/2022\/04\/29\/preventing-sql-injection-in-low-code-web-applications\/\">Preventing SQL injection in low-code web applications<\/a>. <\/p>\n<p><strong>PHP example:<\/strong><\/p>\n<div class=\"my-syntax-highlighter\">\n<pre><textarea id=\"mshighlighter\" class=\"mshighlighter\" language=\"php\" name=\"mshighlighter\" >\r\n$sql = DB::PrepareSQL(\"insert into log (lastname) \r\n  values (':1')\", $values[\"name\"]);\r\nDB::Exec( $sql );<\/textarea><\/pre>\n<\/div>\n<p><strong>C# example:<\/strong><\/p>\n<div class=\"my-syntax-highlighter\">\n<pre><textarea id=\"mshighlighter\" class=\"mshighlighter\" language=\"\" name=\"mshighlighter\" >\r\nsql = DB.PrepareSQL(\"insert into log (lastid) values (:new.id)\");\r\nDB.Exec( sql );<\/textarea><\/pre>\n<\/div>\n<h3>12. Avoid storing sensitive data in your database when possible<\/h3>\n<p>For instance, instead of storing payment card information in your own database, use a payment provider such as <a href=\"https:\/\/stripe.com\/\">Stripe<\/a>. Keeping sensitive payment data out of your application can substantially reduce the security and compliance burden. <\/p>\n<h3>13. Database access isolation<\/h3>\n<p>Make sure each database account has access only to the data and operations required by that application. Avoid reusing the same privileged database credentials across unrelated applications. If one application is compromised, properly isolated credentials help limit what an attacker can access. <\/p>\n<h3>14. File access isolation<\/h3>\n<p>The same isolation principle applies to the file system. If an attacker compromises one web application, you want to limit that application&#8217;s ability to access files belonging to other applications. Here is one approach for IIS and PHP. <\/p>\n<p>Create a folder named <strong>.temp<\/strong> inside this application&#8217;s folder. Provide read\/write permissions for IUSR user. Deny List permissions. In this folder we will store PHP sessions.  <\/p>\n<p>Open this folder in IIS manager and proceed to <strong>Handler Mappings<\/strong>. Click <strong>Edit Feature Permissions<\/strong> on the right. Clear all checkboxes. <\/p>\n<p>Open main application&#8217;s folder in IIS Manager. Double-click on PHP handler and modify the path to PHP executable this way:<\/p>\n<div class=\"my-syntax-highlighter\">\n<pre><textarea id=\"mshighlighter\" class=\"mshighlighter\" language=\"\" name=\"mshighlighter\" >C:\\PHP\\php-cgi.exe|-d session.save_path=\"C:\\inetpub\\wwwroot\\website.com\\appfolder\\.temp\" -d open_basedir=\"C:\\inetpub\\wwwroot\\website.com\\appfolder\\\"<\/textarea><\/pre>\n<\/div>\n<p>The <strong>open_basedir<\/strong> directive can limit the directories PHP is allowed to access. Treat it as an additional safety measure rather than a complete security boundary. <a href=\"https:\/\/www.php.net\/manual\/en\/ini.core.php#ini.open-basedir\">More info on open_basedir<\/a>. <\/p>\n<h3>15. Audit and monitor security-related activity<\/h3>\n<p>Log important security and user activity so suspicious behavior can be investigated. Useful events include successful and failed logins, record changes, and other sensitive operations. PHPRunner and ASPRunner.NET include <a href=\"https:\/\/xlinesoft.com\/phprunner\/docs\/audit.htm\"><strong>Audit<\/strong><\/a> options for logging user actions. Protect the logs from unauthorized changes and review them when investigating unusual activity.<\/p>\n<h3>Adding Web Application Firewall as an extra level of protection<\/h3>\n<p>A Web Application Firewall (WAF) can provide an additional layer of protection by filtering and monitoring HTTP traffic between a web application and the internet. Examples include <a href=\"https:\/\/www.fortinet.com\/products\/web-application-firewall\/fortiweb\">Fortinet FortiWeb<\/a> and <a href=\"https:\/\/sucuri.net\/\">Sucuri Website Firewall<\/a>. Whether you need a WAF depends on your hosting environment, application exposure, and security requirements. <\/p>\n<h3>Preventing automated attacks<\/h3>\n<p>Automated scripts can be used to brute-force passwords and abuse public forms. Use built-in protections such as <strong>Lock user account after three unsuccessful logins<\/strong>, two-factor authentication, and CAPTCHA\/reCAPTCHA where appropriate. <\/p>\n<h2>Testing for vulnerabilities<\/h2>\n<p>How should you test for vulnerabilities and interpret the results? Vulnerability scanners can assess a web application&#8217;s security and identify issues that deserve further review. Well-known products in this area include <a href=\"https:\/\/www.acunetix.com\/web-vulnerability-scanner\/\">Acunetix<\/a> and <a href=\"https:\/\/www.hcltechsw.com\/wps\/portal\/products\/appscan\">HCL AppScan<\/a>. These tools test application pages against known vulnerability patterns and generate a report of their findings. <\/p>\n<p>It is important that developers and the team running the vulnerability scanner work together to interpret results properly. Let me give you an example. There are several types of &#8220;blind injection&#8221; tests, including blind SQL injection and blind LDAP injection. A scanner may send different request parameters to a page and compare the responses, looking for behavior that suggests user-controlled input is affecting the application unexpectedly. <\/p>\n<p>One customer was running a vulnerability scanner against a PHPRunner application. First, the scanner loaded a list page normally. Then it added a random parameter to the request and loaded the page again. The output was different, and the scanner marked the result as a critical vulnerability.<\/p>\n<p>It turned out that the scanner was running against a live database that was being updated constantly. The difference between the two responses was simply the number of records in the table because someone had added a record between the tests. This is why scanner findings need to be reviewed in context rather than accepted automatically. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Updated August 2026. Low-code tools can handle much of the repetitive work involved in building secure web applications, but deployment and configuration still matter. Applications created by PHPRunner and ASPRunner.NET include built-in protections against common web application vulnerabilities such as SQL injection, XSS, and CSRF. For an overview of the most common web application security risks, see the OWASP Top 10. In this article, we focus on additional security measures that are not directly related to generated application code but are still important when deploying&#8230;<span class=\"clearfix clearfix-post\"><\/span><a href=\"https:\/\/xlinesoft.com\/blog\/2021\/06\/17\/secure-low-code-web-applications\/\" class=\"more-link\">Continue Reading <span class=\"screen-reader-text\">&#8220;Building secure low-code web applications&#8221;<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,1,8],"tags":[],"class_list":["post-2422","post","type-post","status-publish","format-standard","hentry","category-asp-net","category-php-category","category-tutorials"],"_links":{"self":[{"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/posts\/2422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/comments?post=2422"}],"version-history":[{"count":42,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/posts\/2422\/revisions"}],"predecessor-version":[{"id":3415,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/posts\/2422\/revisions\/3415"}],"wp:attachment":[{"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/media?parent=2422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/categories?post=2422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xlinesoft.com\/blog\/wp-json\/wp\/v2\/tags?post=2422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}