Common Web Security Vulnerabilities (OWASP)

The OWASP Top 10

OWASP (Open Web Application Security Project) publishes the top 10 most critical web security risks. Every developer should know them.

The Key Vulnerabilities

Risk	What it is
Injection	Malicious code via input (SQL)
Broken Auth	Weak login/session handling
XSS	Inject scripts into pages
Broken Access Control	Users access what they shouldn't
Security Misconfig	Insecure default settings

1. SQL Injection

// ❌ Vulnerable
query("SELECT * FROM users WHERE name = '" + input + "'");

// ✅ Safe — parameterized
query("SELECT * FROM users WHERE name = ?", [input]);

2. Cross-Site Scripting (XSS)

// ❌ Dangerous
element.innerHTML = userInput;

// ✅ Safe
element.textContent = userInput;

How to Protect

• Validate and sanitize all input.
• Use parameterized queries.
• Implement proper authentication.
• Keep dependencies updated.

FAQs

What is the #1 risk?

Injection and broken access control consistently top the list. More in our Security section.

How do I test for these?

Use tools like OWASP ZAP and Burp Suite.