When you're building a website, the worst thing you can do is get hacked. Hackers most often break into websites not through brute-force password cracking, but through holes in the code where they can insert a malicious command. We call this "injection."
In our content management system (RK-CMS) and all its plugins and add-ons, we've built security so secure you don't have to worry about your data's safety. We didn't just write code; we designed a "double filter" system.
Ingress Protection: We Check Everything a User Enters
Imagine your website is a house. Visitors are constantly bringing something: filling out forms, writing comments, using the search engine.
We don't let anyone or anything in without inspection. Absolutely every piece of data a user enters (whether it's text in the "Name" field or a query in the search bar) is filtered.
If an attacker tries to enter a piece of malicious code instead of a username to hack the database, our filter will detect it and neutralize it. The system will simply prevent the attacker's command from being executed. You and your visitors won't even notice the attack attempt—it will be blocked at the input.
Output Protection: We Don't Even Trust Our Own Database
Many developers are complacent about the first point: "We checked the input, so there must be something good in the database." But we don't think so.
Anything can happen: a database can be hacked through another script, or an administrator can accidentally import a "dirty" file. That's why we have a second line of defense.
We filter everything we display on the screen.
Even if a virus or malicious script somehow magically ends up in the database, RK-CMS won't display it in its raw form on the website page. The system automatically converts dangerous code into harmless text that is visible to the naked eye but cannot harm the user's browser.
What specific attacks do we protect against?
To help you understand the scale of the threats, we'll list the most common types of injections that attackers try to use and explain how our protection blocks them.
SQL injections
This is when a hacker attempts to trick the database through a login, search, or subscription form. For example, they enter special code that forces the database to reveal all passwords or delete important tables. Our input filter recognizes such commands and prevents them from executing. The database receives only safe data.
XSS (cross-site scripting)
This is when malicious JavaScript is inserted into a comment, review, or private message. When another visitor opens the page, this script steals their cookies (login information) or redirects them to a fraudulent site. By using output filtering, RK-CMS converts malicious code into plain text that is visible on the screen but not executed by the browser.
Header and Email Injections
Sometimes, attackers try to forge email headers through the contact form to exploit your server for spam. We check all fields and prevent unnecessary commands from being inserted.
Path Traversal
This is an attempt to access server files that shouldn't be visible (such as configuration files) through the address bar or file upload. We control paths and file names, ensuring that data doesn't leave approved folders.
Arbitrary Command Execution
If there is a vulnerability on the server, a hacker can attempt to run system commands directly from the website. Our code is designed to ensure that user data never gets into system calls without first being sanitized.
Why is this important to you?
Many people think, "My website is useless; it won't be hacked." This is a myth. Bots attack every website in search of vulnerabilities. If a site is hacked, they plant viruses to steal passwords or links to illegal products. Search engines quickly detect this and remove the site from search results.
By using RK-CMS, you get a system that cares about your reputation. We monitor everything twice: at the input and at the output. All you have to do is fill the site with content.
