Lesson 05 · 11 min
XSS, SQL injection, CSRF
Three classic attacks and one rule: data is not code.
XSS: a foreign script gets onto your page through user data. SQL injection: data ends up in the text of an SQL query and changes it. CSRF: another site makes the user's browser send a request with their cookies. The root of all three is data executed as code.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.