What is SQL injection and cross-site scripting, and how do you prevent them?

SQL injection occurs when user input is concatenated into a query, so input becomes executable SQL. Entering ' OR '1'='1 into a login field can turn the WHERE clause into something always true.

Prevention:

• Parameterised queries (prepared statements) — the definitive fix. Query structure is sent separately from values, so a value can never be parsed as SQL.
• Least privilege on the database account — the application should not connect as an administrator, limiting damage if something slips through.
• Input validation as defence in depth, never as the primary control.

Cross-site scripting (XSS) injects JavaScript that runs in another user's browser, in their session context — allowing session token theft, keylogging, or actions performed as them. Three types:

• Stored — the payload is saved server-side and served to every visitor. The most dangerous.
• Reflected — the payload comes in a request and is echoed back, requiring the victim to follow a crafted link.
• DOM-based — client-side JavaScript writes untrusted data into the page.

Prevention: context-aware output encoding — HTML, attribute, JavaScript, and URL contexts each need different escaping. A Content Security Policy limits what can execute even if a payload lands. Set session cookies httpOnly so script cannot read them, and use a framework that escapes by default rather than doing it manually.

Note: Both share a root cause: mixing data with code. Say that, and the two answers become one principle.