A1 — Injection (SQL, NoSQL, Command)

Never interpolate user input into queries. Always use parameterised queries or prepared statements:

-- BAD
query = "SELECT * FROM users WHERE email = '" + email + "'"

-- GOOD (parameterised)
query = "SELECT * FROM users WHERE email = ?"
db.execute(query, [email])

A2 — Broken Authentication

  • Short-lived JWTs + rotation (see JWT article).
  • Rate-limit login endpoints. Lock accounts after N failures.
  • Never log passwords, tokens, or session IDs.

A3 — Sensitive Data Exposure

Encrypt PII at rest. Use TLS everywhere. Never return sensitive fields in API responses that do not need them.

A5 — Broken Access Control / IDOR

Insecure Direct Object Reference: GET /orders/4821 should verify the authenticated user owns order 4821. Never trust the ID alone.

-- Always scope queries to the authenticated user
SELECT * FROM orders WHERE id = ? AND user_id = ?

A7 — XSS

Escape all user content before rendering in HTML. Use a framework that auto-escapes (React, Vue). Set Content-Security-Policy headers.