Web Security

You do not need to be a security researcher, but you do need to recognize the handful of attacks that hit web apps constantly.

Most breaches are not exotic — they exploit the same few mistakes again and again. Knowing them is most of the defense.

Injection (including SQL injection)

If you paste user input straight into a command or query, the user can change what it does:

# DANGEROUS — user input glued into SQL
"SELECT * FROM users WHERE name = '" + input + "'"

Input of ' OR '1'='1 turns that into a query matching everyone. Fix: always use parameterized queries — the database treats input as data, never as code.

Cross-site scripting (XSS)

If you render user content as raw HTML, an attacker can inject <script> that runs in your other users’ browsers — stealing sessions or defacing the page. Fix: escape output by default, and set a Content-Security-Policy header to restrict what scripts can run.

Cross-site request forgery (CSRF)

A malicious page makes the victim’s browser send a request to your site using their logged-in cookies. Fix: require a secret CSRF token on state-changing requests, and use SameSite cookies.

Authentication mistakes

Never store passwords in plain text — hash them with bcrypt, scrypt, or argon2.
Put every page behind HTTPS so credentials and cookies are never sent in the clear.
Offer multi-factor authentication for anything sensitive.

A short checklist

Validate and escape all input and output.
Use parameterized queries everywhere.
Keep dependencies patched — most vulnerabilities come from old libraries.
Give accounts and services the least privilege they need.
Do not leak detail in error messages.

Golden rule: never trust input from the client. Validate on the server no matter what the front end already checked — the front end can be bypassed entirely.