Security in web applications protects digital assets from threats spanning injection attacks, broken authentication, data exposure, and misconfigurations. Modern web security operates at multiple layers—from transport encryption and input validation to session management and access control. The OWASP Top 10 2025 remains the definitive reference, with Broken Access Control at #1, Security Misconfiguration rising to #2, and new categories covering software supply chain failures and error handling. Effective security requires defense in depth, continuous monitoring, and awareness of emerging threats including API abuse, LLM prompt injection, and prototype pollution.
What This Cheat Sheet Covers
This topic spans 18 focused tables and 165 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Common Injection Attacks
| Vulnerability | Example | Description |
|---|---|---|
SELECT * FROM users WHERE id = ' + userInput | • Attacker inserts malicious SQL via user input, potentially reading, modifying, or deleting database data • use parameterized queries | |
<script>...</script> saved to database | • Malicious script persists in the database and executes in every viewer's browser • most dangerous XSS variant | |
<script>alert(document.cookie)</script> in URL param | Malicious script injected via request is immediately reflected in the response and executes in the victim's browser | |
document.write(location.hash) | • Vulnerability in client-side JavaScript processes untrusted data • payload never reaches the server | |
system("ping " + userInput) | Attacker executes arbitrary OS commands by injecting shell metacharacters into application inputs | |
fetch("http://169.254.169.254/metadata") | Tricks server into making requests to internal resources or cloud metadata endpoints, exposing credentials |