Introduction
Every modern web application accepts input from users — search boxes, login forms, comment fields, URLs — and stores it, processes it, and shows it back to other users. Web security is the discipline of making sure that this untrusted input cannot be turned into a weapon against the application, its database, or its other users. Three attacks dominate every exam syllabus and every real-world vulnerability list (the OWASP Top 10): XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery) and SQL Injection (SQLi).
For BCS, Bank IT, and IT-officer exams these three appear again and again as MCQs ("Which attack injects malicious script into a trusted website?"), as short questions ("Differentiate CSRF and XSS"), and as written questions ("Explain how to prevent SQL Injection"). This lesson builds each attack from first principles — what the attacker sends, why the server or browser is fooled, what damage results, and exactly how to prevent it — so that you can answer any form the question takes.
Learning objectives
- Define XSS, CSRF and SQL Injection precisely and state the layer each one attacks.
- Explain the root cause common to all three: mixing untrusted data with trusted code/commands.
- Distinguish the three types of XSS (Stored, Reflected, DOM-based).
- Trace, step by step, how a CSRF attack rides on an authenticated session.
- Recognise vulnerable SQL code and rewrite it safely with parameterised queries.
- List and justify the standard defences: output encoding, prepared statements, CSRF tokens, SameSite cookies, input validation, the Same-Origin Policy and CSP.
- Compare the three attacks in a summary table and avoid the classic exam traps.