/* password in db previously hashed with password_hash() function */
function login($db, $email, $pass) {
    $stmt = $db->prepare("SELECT password FROM users WHERE email = ?");
    $stmt->bind_param("s", $email); //HL
    $stmt->execute();
    $user = $stmt->get_result()->fetch_assoc();
    if (!$user || !password_verify($pass, $user['password'])) {
        unset($_SESSION['user_email']);
        return false;
    }
    $_SESSION['user_email'] = $email;
    return true;
}

# password in db previously hashed bcrypt.hashpw function
import bcrypt

def login(db, session, email, password):
    cursor = db.cursor(dictionary=True)
    cursor.execute("SELECT password FROM users WHERE email = %s", (email,))  //HL
    user = cursor.fetchone()
    if not user or not bcrypt.checkpw(password.encode(), user['password'].encode()):
        session.pop('user_email', None)
        return False
    session['user_email'] = email
    return True

/* password in db previously hashed bcrypt.hash function */
const bcrypt = require('bcrypt');

async function login(db, session, email, pass) {
    const [rows] = await db.execute("SELECT password FROM users WHERE email = ?", [email]);  //HL
    const user = rows[0];
    if (!user || !await bcrypt.compare(pass, user.password)) {
        delete session.user_email;
        return false;
    }
    session.user_email = email;
    return true;
}

/* password in db previously hashed BCrypt.HashPassword function */
using BCrypt.Net;
using MySql.Data.MySqlClient;
using Microsoft.AspNetCore.Http;

public async Task<bool> Login(MySqlConnection db, ISession session, string email, string pass)
{
    using var cmd = new MySqlCommand("SELECT password FROM users WHERE email = @email", db);
    cmd.Parameters.AddWithValue("@email", email);  //HL

    using var reader = await cmd.ExecuteReaderAsync();
    if (!await reader.ReadAsync() || !BCrypt.Verify(pass, reader.GetString("password")))
    {
        session.Remove("user_email");
        return false;
    }

    session.SetString("user_email", email);
    return true;
}

/* password in db previously hashed BCrypt.hashpw function */
import org.mindrot.jbcrypt.BCrypt;
import java.sql.*;
import jakarta.servlet.http.HttpSession;

public boolean login(Connection db, HttpSession session, String email, String pass) throws SQLException {
    try (PreparedStatement stmt = db.prepareStatement("SELECT password FROM users WHERE email = ?")) {
        stmt.setString(1, email);  //HL
        ResultSet rs = stmt.executeQuery();

        if (!rs.next() || !BCrypt.checkpw(pass, rs.getString("password"))) {
            session.removeAttribute("user_email");
            return false;
        }

        session.setAttribute("user_email", email);
        return true;
    }
}

/* Maven dependency */
<dependency>
    <groupId>org.mindrot</groupId>
    <artifactId>jbcrypt</artifactId>
    <version>0.4</version>
</dependency>

/* Install via composer:
composer require ezyang/htmlpurifier */

require_once 'HTMLPurifier.auto.php';

function sanitize_html(string $input): string {
    $config = HTMLPurifier_Config::createDefault();
    $config->set('HTML.Allowed', 'b,i,u,strong,em,p,br,ul,ol,li,a[href|title],img[src|alt]');
    return (new HTMLPurifier($config))->purify($input);
}

# Install via pip:
# pip install bleach

import bleach

ALLOWED_TAGS = ['b', 'i', 'u', 'strong', 'em', 'p', 'br', 'ul', 'ol', 'li', 'a', 'img']

ALLOWED_ATTRIBUTES = {
    'a':   ['href', 'title'],
    'img': ['src', 'alt'],
}

def sanitize_html(input: str) -> str:
    return bleach.clean(input, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES, strip=True)

/* Install via npm:
npm install sanitize-html */

const sanitizeHtml = require('sanitize-html');

const ALLOWED_TAGS = ['b', 'i', 'u', 'strong', 'em', 'p', 'br', 'ul', 'ol', 'li', 'a', 'img'];

const ALLOWED_ATTRIBUTES = {
    'a':   ['href', 'title'],
    'img': ['src', 'alt'],
};

function sanitizeHtmlInput(input) {
    return sanitizeHtml(input, {
        allowedTags: ALLOWED_TAGS,
        allowedAttributes: ALLOWED_ATTRIBUTES,
    });
}

/* Install via dotnet:
dotnet add package HtmlSanitizer */

using Ganss.Xss;

public static string SanitizeHtml(string input)
{
    var sanitizer = new HtmlSanitizer();

    sanitizer.AllowedTags.Clear();
    foreach (var tag in new[] { "b", "i", "u", "strong", "em", "p", "br", "ul", "ol", "li", "a", "img" })
        sanitizer.AllowedTags.Add(tag);

    sanitizer.AllowedAttributes.Clear();
    sanitizer.AllowedAttributes.Add("href");
    sanitizer.AllowedAttributes.Add("title");
    sanitizer.AllowedAttributes.Add("src");
    sanitizer.AllowedAttributes.Add("alt");

    return sanitizer.Sanitize(input);
}

/* Install via Gradle:
implementation 'org.jsoup:jsoup:1.17.2' */

import org.jsoup.Jsoup;
import org.jsoup.safety.Safelist;

public static String sanitizeHtml(String input) {
    Safelist safelist = new Safelist()
        .addTags("b", "i", "u", "strong", "em", "p", "br", "ul", "ol", "li", "a", "img")
        .addAttributes("a",   "href", "title")
        .addAttributes("img", "src",  "alt");

    return Jsoup.clean(input, safelist);
}

<dependency>
    <groupId>org.jsoup</groupId>
    <artifactId>jsoup</artifactId>
    <version>1.17.2</version>
</dependency>

• Use Content Security Policy (CSP) headers.

• PHP
• Python
• Node
• .Net
• Java

header("Content-Security-Policy:
    default-src 'self';
    script-src  'self';
    style-src   'self' 'unsafe-inline' https://fonts.googleapis.com;
    img-src     'self' data: https:;
    font-src    'self' https://fonts.gstatic.com;
    connect-src 'self';
    frame-src   'none';
    object-src  'none';
");

# With Flask
@app.after_request
def set_csp(response):
    response.headers['Content-Security-Policy'] = (
        "default-src 'self'; "
        "script-src 'self'; "
        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
        "img-src 'self' data: https:; "
        "font-src 'self' https://fonts.gstatic.com; "
        "connect-src 'self'; "
        "frame-src 'none'; "
        "object-src 'none';"
    )
    return response

# Django (middleware.py):
# pip install django-csp

class CSPMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        response['Content-Security-Policy'] = (
            "default-src 'self'; "
            "script-src 'self'; "
            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
            "img-src 'self' data: https:; "
            "font-src 'self' https://fonts.gstatic.com; "
            "connect-src 'self'; "
            "frame-src 'none'; "
            "object-src 'none';"
        )
        return response

# Then register it in settings.py:
MIDDLEWARE = [
    'yourapp.middleware.CSPMiddleware',
    ...
]

• Escape output in HTML, JavaScript, and CSS contexts.
• Use frameworks that automatically handle XSS protection.

#Via Group Policy:
# Win + R → gpedit.msc
# Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment
# Find "Increase scheduling priority" and restrict users

# Limit processes for a specific user using job objects
# Requires third-party tools like Process Lasso or SysInternals for per-user limits
# Windows doesn't have a native per-user process limit like Linux — use Process Lasso or SysInternals PsExec for granular control.

# /etc/security/limits.conf file contents:
# Max processes per user
username    hard    nproc    100
# Or for all users
*           hard    nproc    100

# Temporary in shell:
ulimit -u 100

# Verify in shell:
ulimit -u

# Edit /etc/launchd.conf (older macOS) or use launchctl:
# Check current limits
launchctl limit maxproc

# Set limit
sudo launchctl limit maxproc 100 200
# (soft limit 100, hard limit 200)

# Or via /etc/sysctl.conf:
kern.maxprocperuid=100
sudo sysctl -w kern.maxprocperuid=100

• Implement monitoring and alerting for unusual process activity.
• Educate users about the dangers of executing untrusted code.