Beginner LevelWeb Security & Cyber Defense
Explain OWASP Top 10 vulnerabilities (XSS, CSRF, SQL Injection) and their defenses.
❓ Interview Prompt: How do Stored vs Reflected XSS work? How do parameterized queries prevent SQL Injection, and how do SameSite cookies defend against CSRF?
1
XSS (Cross-Site Scripting): Attacker injects malicious JavaScript executed in victims' browsers.
•
Defense: Context-aware output encoding, Content Security Policy (CSP), and avoiding 'dangerouslySetInnerHTML' or 'eval()'.
2
SQL Injection: Attacker injects raw SQL strings into database queries.
•
Defense: Prepared statements (parameterized queries) or ORMs.
3
CSRF (Cross-Site Request Forgery): Attacker tricks victim's browser into making unwanted authenticated requests.
•
Defense: 'SameSite=Strict' cookies, Anti-CSRF tokens, and custom request headers.
Code Implementation Example
typescript
// ❌ Vulnerable to SQL Injection
const queryBad = 'SELECT * FROM users WHERE email = '\${userInput}'';
// ✅ Secure: Parameterized SQL Query
const queryGood = await db.query(
'SELECT * FROM users WHERE email = $1',
[userInput]
);💡Vulnerable SQL string concatenation vs secure parameterized query.
🎯 Interview Key Takeaway
Always parameterize database queries and encode user outputs to neutralize SQL Injection and XSS attacks.
#Security#OWASP#XSS#CSRF#SQL Injection#Beginner
Back to all Web Security & Cyber Defense Questions→