Adding variable usage

content/posts/code-complete-summations-variable-names.md

@@ -1,10 +1,51 @@
 ---
-title: "Variable Names: Code Complete Summations"
-date: 2023-11-13
-draft: true
+title: "Variable Usage: Code Complete Summations"
+date: 2024-02-23
+draft: false
 ---
 
 # Introduction
 
-Something that is probably overlooked when talking about creating secure programs is variable names. It seems simple at first, but can cause major problems in developing complex programs.
+In this summation of "Code Complete 2" by Steve McConnell we will focus on variable naming and usage and how it ralates to security. Variable naming is an essential aspect of software development, and it plays a critical role in ensuring software security.
 
+# Importance of Variable Naming
+
+Variable naming is important for software security because it helps to prevent common programming errors that can lead to security vulnerabilities. For example, if a variable is named incorrectly, it can be difficult to understand its purpose, which can lead to confusion and errors in the code. This can make it easier for attackers to exploit vulnerabilities in the software.
+
+In addition, poorly named variables can make it difficult to identify and fix security vulnerabilities. For example, if a variable is named "userInput," it may not be immediately clear that it contains sensitive data that needs to be properly validated and sanitized. This can lead to security vulnerabilities, such as SQL injection or cross-site scripting (XSS) attacks.
+
+On the other hand, well-named variables can help to prevent security vulnerabilities by making it clear what data the variable contains and how it should be used. For example, a variable named "sanitizedUserInput" clearly indicates that the data has been sanitized and is safe to use in a SQL query or HTML page.
+
+# How to Name Variables
+
+There are several things to keep in mind when naming variables:
+
+1. Use descriptive names: Use variable names that accurately describe the data they contain. For example, instead of using a name like "x," use a name like "sanitizedUserInput" to indicate that the data has been sanitized and is safe to use.
+2. Avoid ambiguous names: Avoid using variable names that are ambiguous or confusing. For example, avoid using names like "data" or "info," as they don't provide any information about the data the variable contains.
+3. Use meaningful prefixes: Use meaningful prefixes to indicate the type of data a variable contains. For example, use a prefix like "sanitized" to indicate that the data has been sanitized and is safe to use.
+4. Use consistent naming conventions: Use consistent naming conventions throughout your code. This will make it easier to understand and maintain your code, and will help to prevent errors and security vulnerabilities.
+5. Avoid using sensitive data in variable names: Avoid using sensitive data, such as user passwords or credit card numbers, in variable names. This will help to protect the data from being accidentally exposed or leaked.
+
+# Variable Usage
+
+Another important aspect of variables is generally how they are used.
+
+## Position
+
+Similar to how good variable names helps with the readability and maintainability of the codebase, so does variable position. By declaring a variable close to its usage, keeps the code organized. It also helps with making sure variables are freed when leaving scope.
+
+By keeping the position close to use, we can also keep the time to "live" short as well. The less code a particular variable spans, the less likely it is to be miss-used.
+
+## Initialization
+
+All variables should be initialized as they are declared as well. By doing so, we avoid the situation of attempting to use an empty variable. This is particularly important for pointers as it can cause memory leaks or out of bounds writes.
+
+## One Purpose
+
+When declaring and using a variable, make sure it's only used for one specific purpose. If the reason for a variable's existence changes part way through, it can make the code base very confusing and hard to maintain. It can also lead to mistaken identity, which will cause errors.
+
+This is especially problematic for non-strongly typed languages, as not only the purpose, but type, of the variable could change.
+
+# Conclusion
+
+In conclusion, variable naming and usage are important aspect of software security. By using descriptive and meaningful variable names, you can help to prevent common programming errors and security vulnerabilities. by keeping variables close, short, and single purposed, you increase the maintainability of the codebase and reduce the possibility of misuse.