Security: SQLi, CSRF & XSS
This course covers three web attacks and where OWASP files them: SQL injection and XSS under Injection, CSRF under Broken Access Control. It builds a SQL injection on a disposable table and shows the parameterized query patterns this app already uses. It explains how Rails checks the CSRF token, what a mismatch raises and why the token is masked. It names the three kinds of XSS, compares raw and .html_safe, reads the app's Content-Security-Policy, and ends with a pull request review that uses all three.
What you'll learn
- ✓How the OWASP Top 10:2025 places SQL injection, XSS and CSRF in two categories
- ✓How SQL injection works and how ? placeholders and hash conditions prevent it
- ✓How sanitize_sql_like escapes LIKE wildcards in search terms
- ✓How Rails verifies CSRF tokens, its failure strategies and token masking
- ✓Stored, reflected and DOM-based XSS, and how raw and .html_safe skip escaping
- ✓How this app's Content-Security-Policy limits scripts with allowed origins and nonces
Three letters, two different OWASP categories
"SQLi, CSRF and XSS" in one course title reads like three attacks from the same family. The OWASP Top 10:2025, the current official ranking of web application security risks, says otherwise. SQL injection and XSS both sit in one category, A05:2025 Injection, whose page names both: "Injection…
Read the full lesson free →Curriculum
7 lessonsThree letters, two different OWASP categories
Shows why OWASP places SQL injection and XSS under Injection and CSRF under Broken Access Control.
SQL injection: untrusted input, executed as commands
Builds a vulnerable query on a disposable table and shows how a ? placeholder quotes the value safely.
This app's query patterns, already safe
Reads this app's raw SQL conditions, search query and hash conditions to show each one handles values safely.
CSRF, deeper: how the check works, and a mismatch
Explains how Rails compares CSRF tokens, the three failure strategies, token masking and SameSite cookies.
XSS, deeper: kinds of attack, raw and sanitize
Names stored, reflected and DOM-based XSS, compares raw with .html_safe, and shows how this app escapes user content.
Defense in depth: this app's CSP header
Reads this app's Content-Security-Policy, including script sources, WebAssembly exceptions on lesson pages and nonces for inline scripts.
Putting it together: reviewing a PR through this course's lens
Reviews a three-line pull request with SQL injection, disabled CSRF protection and XSS, writing one blocking comment each.