A1 — Injection (SQL, NoSQL, Command)
Never interpolate user input into queries. Always use parameterised queries or prepared statements:
-- BAD
query = "SELECT * FROM users WHERE email = '" + email + "'"
-- GOOD (parameterised)
query = "SELECT * FROM users WHERE email = ?"
db.execute(query, [email])
A2 — Broken Authentication
- Short-lived JWTs + rotation (see JWT article).
- Rate-limit login endpoints. Lock accounts after N failures.
- Never log passwords, tokens, or session IDs.
A3 — Sensitive Data Exposure
Encrypt PII at rest. Use TLS everywhere. Never return sensitive fields in API responses that do not need them.
A5 — Broken Access Control / IDOR
Insecure Direct Object Reference: GET /orders/4821 should verify the authenticated user owns order 4821. Never trust the ID alone.
-- Always scope queries to the authenticated user
SELECT * FROM orders WHERE id = ? AND user_id = ?
A7 — XSS
Escape all user content before rendering in HTML. Use a framework that auto-escapes (React, Vue). Set Content-Security-Policy headers.