The OWASP Top 10 (Intro to Common Vulnerabilities)

OWASP publishes a regularly-updated list of the most common web application vulnerabilities. One you'll run into constantly as a developer:

Example: SQL injection, vulnerable vs. fixed

# Vulnerable — user input is glued directly into the query string
query = f"SELECT * FROM users WHERE username = '{username}'"

# Safe — the database driver keeps the value separate from the query itself
cursor.execute("SELECT * FROM users WHERE username = %s", [username])

The vulnerable version lets an attacker end the string early and append their own SQL by typing something like ' OR '1'='1 into the username field. The parameterized version treats the input purely as data, no matter what it contains — the database driver never lets it become part of the executable query structure at all. This is exactly the same "never trust the browser or the input alone" principle the Forms lessons across HTML, PHP, and Django all raise from a different angle — here it's the specific, concrete consequence of skipping it.