Web security encompasses the practices and controls that protect web applications from attacks that threaten confidentiality, integrity, and availability. In the modern threat landscape, where applications process sensitive data and connect users across untrusted networks, defending against injection attacks, authentication bypasses, and misconfigurations is no longer optional—it's a fundamental requirement. Understanding how attackers exploit common vulnerabilities like XSS, CSRF, and SQL injection, and knowing the concrete patterns and headers that prevent them, equips developers to build systems that resist both automated scanning and targeted exploitation.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 159 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Injection Attack Types
| Attack | Example | Description |
|---|---|---|
SELECT * FROM users WHERE id = '$input' | • Malicious SQL code inserted through user input that manipulates database queries • prevented by parameterized queries and prepared statements. | |
<script>alert(document.cookie)</script> | • Injection of malicious JavaScript into web pages viewed by other users • executes in victim's browser context enabling session theft and account takeover. | |
<!DOCTYPE foo > | • Exploits XML parsers to access local files or trigger server-side requests • prevented by disabling external entity processing in XML parsers. | |
http://app.com/fetch?url=http://169.254.169.254/ | • Tricks server into making requests to internal resources or cloud metadata endpoints • requires URL allowlisting and internal IP blocking. |