Common web attacks and defenses
This chapter organizes major web application attacks — XSS, CSRF, SQL injection — from "conditions that let each succeed" and derives defenses by breaking those conditions. It covers the difference between escaping and placeholders, the relationship between CSRF tokens and SameSite, and why access-control failures rank