The OWASP Top 10.

OWASP is a global non-profit that publishes the most common and dangerous web application risks. Every web developer and security tester is expected to know this list. Today you'll understand each one with a simple example.

Your teacher says

You don't need to memorise the numbers. You need to understand the ideas. In an interview, explaining one risk clearly beats listing ten names.

The list (OWASP Top 10, 2021 edition)

Deep dive 1: SQL injection

Databases are queried using a language called SQL. A login might check:

SELECT * FROM users WHERE roll = 'INPUT1' AND password = 'INPUT2';

If the code just glues user input into that sentence, an attacker can type special characters that change the meaning of the command, for example making the condition always true and logging in without a password.

The fix: never build SQL by gluing strings. Use parameterised queries (prepared statements), where input is always treated as data, never as part of the command.

Remember the analogy

It's like a waiter who reads out your order word-for-word to the kitchen, including "...and also give me the cash box". A good waiter (parameterised query) only passes the dish name, nothing more.

Deep dive 2: Cross-Site Scripting (XSS)

If a website shows user input on a page without cleaning it, an attacker can put JavaScript into, say, a comment. When other people view the page, that script runs in their browser, and can steal their session cookie (Lesson 13).

The fix: encode output (show <script> as text, never run it), validate input, use the HttpOnly cookie flag and a Content Security Policy.

Deep dive 3: Broken access control

The number one risk. Examples:

• Changing /invoice?id=1045 to 1046 shows someone else's invoice (IDOR).
• A normal user opens /admin just by typing the URL, and it works.
• A student changes role=student to role=teacher in a request.

The fix: the server checks permissions on every request, for every object, and denies by default.

How companies find these problems

• Code review and secure coding training for developers.
• Automated scanners (SAST for code, DAST for running sites).
• Penetration tests: hired testers attack the app with permission.
• Bug bounty programmes: companies like Google, Meta and many Indian startups pay people who responsibly report vulnerabilities. Some Indian researchers have earned well this way, but only by following each programme's rules exactly.