Cybersecurity Foundations·A security baseline you can use

XSS, SQL injection and CSRF

Most web attacks exploit a trust boundary that was never made explicit.

Beginner 15 min read Lesson 8 of 300 Challenge included

What you will be able to do

Use parameterised SQL; never concatenate user input into queries.
Render untrusted text as text, not as HTML.
Use sameSite cookies and CSRF tokens for state-changing requests.

In plain English

XSS occurs when untrusted data becomes executable markup. SQL injection occurs when data becomes query syntax. CSRF exploits ambient cookies on a state-changing request. Parameterise queries, escape at render time and protect state changes with anti-CSRF defenses.

safe-query.jsJavaScript

// Wrong: input becomes SQL syntax
db.query('select * from users where email = ' + email)

// Right: data stays data
db.query('select id, email from users where email = $1', [email])

// Escape at the rendering boundary, not at input time
element.textContent = comment
// Avoid innerHTML with untrusted content.

Your turn

Parameterise a lookup

Medium

Rewrite a query that concatenates an email into a parameterised query.

JS · starter

db.query("select * from users where email = '" + email + "'")

Check your understanding before moving on.

Knowledge checkQuestion 1

What is the primary defense against SQL injection?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Headers, TLS and secrets

Lesson 8 of 300 · 0% of course