These three vulnerability classes account for a large share of real-world web security incidents, and being able to show the actual exploit — not just name it — demonstrates genuine understanding.

SQL injection: user input gets concatenated directly into a SQL query string, letting an attacker inject their own SQL logic.

# VULNERABLE — user input concatenated directly into the query
query = f"SELECT * FROM users WHERE username = '{username}'"
# if username = "' OR '1'='1", the query becomes:
# SELECT * FROM users WHERE username = '' OR '1'='1'  — returns every row

# SAFE — parameterized query, the database treats the value as pure data, never as code
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

Cross-site scripting (XSS): unescaped user input gets rendered directly into an HTML page, letting an attacker inject a script that runs in another user's browser — stealing their session cookie, for instance. The fix is output encoding: escaping characters like < and > so injected content is displayed as inert text rather than executed as markup or script.

Cross-site request forgery (CSRF): a malicious site tricks a logged-in user's browser into submitting a request to a different site where they're authenticated — since cookies are sent automatically by the browser regardless of which page initiated the request, a hidden form on an attacker's page can trigger a state-changing action (like transferring money) using the victim's own valid session. Defenses include a CSRF token unique per session that must be included in the request body (which the attacker's page cannot know) and checking the request's origin/referrer header.

Why passwords need slow, salted hashing (bcrypt, scrypt, Argon2), not encryption: encryption is reversible by design — anyone with the key can recover the original password, which is exactly the wrong property for password storage (if the database leaks, every password leaks in plaintext). A slow hash function is deliberately expensive to compute, making brute-force guessing attacks impractically slow even if the hash database leaks, and a per-user random salt prevents attackers from using precomputed "rainbow tables" of common password hashes across every user at once.