These five web security issues affect a large number of websites. For each one, this article explains what it is and how to prevent it.

1. SQL injection (SQLi)

In an SQL injection attack, malicious input changes a database query. Attackers use it to read sensitive data such as user logins and payment details, to add, change or delete records, and to bypass login checks. It is one of the oldest and most dangerous web attacks, and it has been in the OWASP Top 10 since the list began.

How to prevent SQL injection

• Use parameterised queries with bound, typed parameters in every database call. All major languages and frameworks, including .NET, PHP and Java, support them.
• Use stored procedures carefully, and never build SQL by joining strings with user input.
• Install security updates promptly.
• A web application firewall (WAF) adds a layer of protection, but it does not replace fixing the code.

2. Cross-site scripting (XSS)

XSS lets an attacker inject client-side scripts into pages viewed by other users. There are three main types:

• Stored XSS: the payload is saved by the application, for example in a comment, and runs every time a user views the page. This usually makes it the most dangerous type.
• Reflected XSS: the payload is in the URL or the request and is reflected in the response. It is not saved, so it affects users who open a crafted link.
• DOM-based XSS: the page's own JavaScript writes attacker-controlled data into the page.

XSS is commonly used to steal session cookies and tokens, or to change what the page shows.

How to prevent XSS

• Encode all user-supplied data for its output context before it is shown in the browser.
• Validate input, and avoid unsafe JavaScript functions such as innerHTML and eval.
• Use a Content Security Policy, and set session cookies to HttpOnly.

3. Cross-site request forgery (CSRF)

CSRF, sometimes called session riding, forces a logged-in user's browser to send a request the user did not intend. A malicious site triggers it with crafted images, scripts or hidden forms. XSS exploits the trust a user has in a website; CSRF exploits the trust a website has in the user's browser.

How to prevent CSRF

• Add an anti-CSRF token to each form: a value the attacker cannot know, which the server validates.
• Set the SameSite attribute on session cookies.

4. Directory traversal

Directory (path) traversal lets an attacker access files and directories outside the intended folder. It can expose sensitive data and, in some cases, lead to a full server compromise. It usually comes from insufficient validation of file names or paths supplied by the user.

How to prevent directory traversal

• Do not build file paths from user input. Map identifiers to files on the server instead.
• Validate input and verify that the final path stays inside the allowed directory.
• Keep web server software up to date.

5. Distributed denial of service (DDoS)

In a denial-of-service (DoS) attack, a large amount of traffic is sent to a server to use up its bandwidth or resources, so legitimate users cannot reach it. A single computer is rarely enough against a well-provisioned server, so attackers use many computers at once, often a botnet. This is a distributed denial-of-service attack.

How to reduce the impact of a DDoS attack

• Know your normal traffic patterns so unusual spikes are detected early.
• Use a DDoS protection service or content delivery network that can absorb and filter attack traffic.
• Apply rate limiting, and block traffic from sources that are clearly malicious.
• Provision spare capacity; it helps with smaller attacks.

How Vooki Pro helps

• Covers these issues with more than 300 active checks plus version and CVE checks.
• Scans behind the login with auth profiles and automatic re-login.
• Sends findings to Jira, GitHub, GitLab, Linear or Azure DevOps.

Frequently asked questions

Which web security issues matter most?

Those that expose data or accounts: injection, broken access control, authentication flaws and misconfiguration.

How often should I check for them?

Continuously: on every release and on a regular schedule.

Related: Common website vulnerabilities · Scheduling recurring security scans