Security Fundamentals for Developers
Demo Creator
@seed-creator · muallif
The Attacker's Mindset
Security starts with thinking like an attacker. For every input field, ask: what happens if I send 10 MB of data? What if I send a null byte? What if I send SQL syntax?
Security is not a feature you add at the end. It is a habit you build from the first line of code.
Cross-Site Scripting (XSS)
XSS injects script into a page viewed by other users. Content Security Policy prevents inline scripts from executing. Output encoding — escaping < > " ' in rendered HTML — prevents injection in the first place.
innerHTML is dangerous. Use textContent or a sanitizer library like DOMPurify when you must render user-supplied HTML.
SQL Injection
SQL injection is trivially prevented by parameterized queries. Never interpolate user input into a query string. ORMs parameterize automatically; raw SQL strings are a red flag in code review.
CSRF Protection
SameSite=Strict cookies prevent cross-site requests from carrying the session cookie. Combined with a short-lived CSRF token in the request body, CSRF becomes impractical to exploit.
0 ta izoh
Tizimga kiring izoh qoldirish uchun.