Web Security: XSS, SQL Injection and CSRF For students.

Web security is the practice of protecting websites and web applications from attacks. Three classic attacks every developer must understand are XSS (Cross-Site Scripting), SQL injection, and CSRF (Cross-Site Request Forgery). Each exploits the trust a web application places in user input or in the user's browser.

They matter because web apps hold the world's most sensitive data — bank balances, medical records, private messages — and these three attacks have caused some of history's biggest breaches. They are also almost entirely preventable with well-known defenses, which makes understanding them a core skill for every developer.

Key Concepts

• XSS (Cross-Site Scripting): an attacker injects malicious JavaScript into a page that other users then load. The script runs in victims' browsers with the site's trust.
• SQL injection: attacker input is stitched into a database query, changing what the query does — for example turning a login check into "always true".
• CSRF (Cross-Site Request Forgery): an attacker tricks a logged-in user's browser into making an unwanted request, like transferring money, by abusing the browser's automatic cookie sending.
• Input validation: checking that user input matches expectations before using it.
• Output encoding: converting characters like < and > into safe entities so browsers display them instead of executing them.
• Parameterized queries: sending SQL code and user data separately so data can never be mistaken for code.
• CSRF token: a secret value embedded in forms that an attacker's site cannot know, proving the request came from your own pages.

How It Works

XSS attack: a comment form saves raw input. An attacker posts a script tag with cookie-stealing code. Every visitor's browser runs it, sending their session cookies to the attacker.

SQL injection attack: login code builds the query: SELECT * FROM users WHERE name='INPUT' AND pass='INPUT2'. The attacker types ' OR '1'='1 into the name field, making the query … WHERE name='' OR '1'='1' … — always true, so they log in as the first user without any password.

CSRF attack: you are logged into your bank. A malicious page contains an image tag pointing at the bank's transfer URL with the attacker's account. Your browser loads it, automatically attaching your bank cookies, and the transfer executes as you.

Defenses: encode all output (kills XSS), use parameterized queries (kills SQL injection), and require CSRF tokens on state-changing requests (kills CSRF). Validate input on top as defense in depth.

Worked Example

Password strength shows why input rules matter. A 4-digit PIN has 10⁴ = 10,000 possibilities. An attacker trying one per second needs 10,000 seconds ≈ 2.8 hours to try them all — but a lockout after 5 wrong attempts stops this cold.

Now compare an 8-character password using 62 symbols (a–z, A–Z, 0–9): 62⁸ ≈ 2.18 × 10¹⁴ possibilities. At one million guesses per second — far faster than any web login allows — cracking takes 2.18 × 10¹⁴ / 10⁶ = 2.18 × 10⁸ seconds ≈ 6.9 years. Longer, mixed-character passwords plus rate-limiting turn brute force from minutes into lifetimes.

Common Misconceptions

• "Client-side validation is enough." Attackers bypass browser JavaScript entirely with tools like curl. All security checks must run on the server.
• "My site is too small to be attacked." Bots scan the entire internet automatically; small sites are attacked constantly without being personally targeted.
• "HTTPS prevents these attacks." HTTPS encrypts traffic in transit but does nothing about malicious input once it arrives. Injection and XSS work fine over HTTPS.

Real-World Applications

• Login systems: parameterized queries stop attackers from logging in without passwords.
• Comment sections and forums: output encoding stops stored XSS from hijacking readers' sessions.
• Banking and payments: CSRF tokens stop malicious sites from triggering transfers with your cookies.
• Bug bounty programs: companies pay researchers who find these exact flaws before criminals do.

XSS, SQL injection, and CSRF all exploit one root mistake: trusting input. Encode output, separate code from data, and verify that requests are genuine — three habits that neutralize the web's most famous attacks. Security is not a feature you add later; it is how you handle input from the very first line.