Web Security

🔒 OWASP Top 10 Web Security Reference

Defensive guidelines for preventing XSS, SQL Injection, CSRF, and broken access controls in web applications.

1. Content Security Policy (CSP) Headers

# Restrict Resource Loading to Same-Origin
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-rAnd0m'; object-src 'none';

2. SQL Injection Prevention

// Parameterized PDO Query (PHP)
$stmt = $pdo->prepare('SELECT id, username FROM users WHERE email = :email');
$stmt->execute(['email' => $userInput]);