How do I prevent injection, XSS, CSRF and SSRF?

Definition:

Injection, XSS, CSRF and SSRF attack different trust boundaries. Injection changes a database command, XSS runs unwanted browser code, CSRF abuses automatically attached credentials, and SSRF makes a server contact an unintended destination. Input validation helps, but each attack also needs controls at the point where the dangerous action happens.

Key points:

• Injection: use query parameters and validate allowed fields/operators.

• XSS: use safe output handling; CSRF: protect cookie-authenticated changes with origin checks and CSRF controls.

• SSRF: restrict outbound destinations and check redirects and resolved addresses.

• For example, a syntactically valid URL may still point to a private service, so URL-format validation alone does not prevent SSRF.

Interview point:

• Name the attack, the trusted capability it abuses and the defense applied at that boundary.