In this paper, a practical state estimation strategy against joint sensor and actuator attacks is proposed for cyber-physical systems (CPSs). The CPSs are formulated based on delta operator for the requirement of real control systems with high-sampling or variable-sampling periods. The attacks fulfilling sparse observation condition are supposed to be randomly injected into both sensor and actuator units. Various numbers of attacks on sensors and actuators can be properly handled. Based on multiple observations of the attacked measurements, a new estimator in delta-domain is proposed to estimate the states of the attacked CPS. The convergence of the corresponding estimation error is analyzed based on pole assignment analysis and some matrix equality constraints. Further, by utilization of a dissipativity approach, estimator-based time-driven controller and self-triggered controller are designed for the enhancement of the estimations and the resource saving. Simulations for the joint attack scenario are provided to testify the applicability and effectiveness of the proposed estimation methods.