The OWASP Top 10 with fixes

Why web apps matter

Banking, shopping, government services and company tools are all web apps or APIs. They face the whole internet, so their bugs are found quickly. OWASP (Open Worldwide Application Security Project) is a non-profit community that publishes free guides; its Top 10 lists the most common and serious web risks, based on data from many organisations.

The list and its fixes

The table uses the 2021 names, which are still the ones most courses, exams and interviews use. OWASP released a newer 2025 edition: it keeps broken access control at number one, adds software supply chain failures and mishandling of exceptional conditions, and folds server-side request forgery into broken access control. Always check owasp.org for the current list.

Injection, up close

SQL injection happens when user input is glued into an SQL query as text. The database cannot tell your query from the attacker's input. The fix is a parameterised query: the query and the data are sent separately, so input is always treated as data.

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE users (name TEXT, role TEXT)")
db.executemany("INSERT INTO users VALUES (?, ?)", [("asha", "admin"), ("ravi", "staff")])

name = "nobody' OR '1'='1"
unsafe = db.execute(f"SELECT * FROM users WHERE name = '{name}'").fetchall()
safe = db.execute("SELECT * FROM users WHERE name = ?", (name,)).fetchall()
print(len(unsafe), len(safe))

Broken access control, up close

An IDOR (insecure direct object reference) is a common access control bug: the app uses an ID from the request without checking it belongs to the user. Hiding a button is not access control; attackers call the API directly. Every request must be checked on the server.

Cross-site scripting (XSS)

XSS is injection into a web page: an attacker gets their script into a page that other users view, for example in a comment. The browser runs it as if it came from the site, and it can steal session data or act as the user. Fixes: encode output (turn < into &lt;), use frameworks that escape by default, add a Content-Security-Policy, and set HttpOnly on session cookies.

Detection matters too

• A web application firewall (WAF) blocks common attack patterns and logs attempts.
• Web logs show probing: many 404s, quotes and SQL words in parameters, 500 errors.
• Practise only on legal targets: OWASP Juice Shop or DVWA in your own lab, or PortSwigger Web Security Academy.

Common mistakes

• Relying on front-end checks only.
• Escaping input "by hand" with replace() instead of using parameterised queries and the framework's encoder.
• Showing full error messages and stack traces to users.
• Forgetting APIs and mobile app back-ends; they need the same checks as the website.