Web App Security Basics That Prevent Most Hacks

Real-world hacks of normal apps are rarely Hollywood-level. They exploit the same boring gaps every time. Close these and you are ahead of the vast majority of targets.

Injection: never glue user input into queries

// DANGEROUS: user input inside the SQL string
const rows = await db.query(
  "SELECT * FROM users WHERE email = '" + email + "'"
)
// email = "x' OR '1'='1" now returns every user

// SAFE: parameterized query, input can never become SQL
const rows = await db.query(
  'SELECT * FROM users WHERE email = $1', [email]
)

Passwords: hash, never store

import bcrypt from 'bcrypt'

// On signup: store only the hash
const hash = await bcrypt.hash(password, 12)

// On login: compare against the hash
const ok = await bcrypt.compare(password, user.passwordHash)

Secrets: environment variables, never code

# .env (git-ignored)
STRIPE_SECRET_KEY=sk_live_...
DATABASE_URL=postgres://...

# .gitignore
.env
.env.local

// In code, read from the environment
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY)

Rate-limit the sensitive endpoints

Login, password reset, and signup endpoints get hammered by bots trying leaked passwords. A basic limiter shuts that down:

import rateLimit from 'express-rate-limit'

app.use('/login', rateLimit({
  windowMs: 15 * 60 * 1000,   // 15 minutes
  limit: 10,                  // 10 attempts per IP
}))

The rest of the checklist

• Keep frameworks and packages updated, most breaches use known old holes
• Validate every input on the server, browser checks are decoration
• Two-factor auth on your own hosting, domain, and admin accounts
• HTTPS everywhere, cookies set to Secure and HttpOnly
• Escape output in templates to prevent XSS; framework defaults do this, do not bypass them

None of this needs a security consultant. It needs discipline during normal development, which is exactly when it is cheapest.