In 15+ years of building and auditing web applications, we have seen the same security mistakes repeated across projects. Most vulnerabilities are not exotic zero-days ÔÇö they are well-known issues with well-known fixes that teams skip because "we will add security later." Later never comes, and the breach happens.
Here are the ten vulnerabilities we encounter most frequently, with specific prevention techniques for PHP and JavaScript applications.
1. SQL Injection
Still the most dangerous vulnerability. If your application concatenates user input into SQL queries, you are vulnerable.
- Fix: Use parameterized queries or prepared statements. In CodeIgniter, use Query Builder or
$db->query('SELECT * FROM users WHERE id = ?', [$id]). Never concatenate$_GETor$_POSTvalues into SQL strings. - Test: Try entering
' OR 1=1 --in your login form. If it works, you have a problem.
2. Cross-Site Scripting (XSS)
Occurs when user-supplied data is rendered in HTML without escaping. An attacker injects JavaScript that steals session cookies or redirects users.
- Fix: Always escape output. In PHP:
htmlspecialchars($data, ENT_QUOTES, 'UTF-8'). In JavaScript: usetextContentinstead ofinnerHTML. Use Content Security Policy headers.
3. Cross-Site Request Forgery (CSRF)
Tricks authenticated users into performing actions they did not intend. A hidden form on a malicious site submits a POST to your app using the user's session.
- Fix: Include a CSRF token in every form. CI4 has built-in CSRF protection ÔÇö enable it in
app/Config/Filters.php. Verify the token on every state-changing request.
4. Broken Authentication
Weak password policies, missing brute-force protection, and session fixation attacks.
- Fix: Hash passwords with
password_hash()(bcrypt). Implement account lockout after 5 failed attempts. Regenerate session ID on login. Use secure, httpOnly, sameSite cookies.
5. Insecure Direct Object References (IDOR)
When changing a URL parameter like /invoice/123 to /invoice/124 shows someone else's invoice. Shockingly common in Indian web applications.
- Fix: Always verify that the authenticated user has permission to access the requested resource. Check ownership at the query level:
WHERE id = ? AND company_id = ?.
6. Security Misconfiguration
Default credentials, directory listing enabled, debug mode in production, exposed .env files.
- Fix: Disable directory listing. Set
ENVIRONMENT = 'production'. Block access to.env,.git, and config files via.htaccessor nginx config. Remove default accounts.
7. Sensitive Data Exposure
Storing passwords in plain text, transmitting data over HTTP, logging sensitive information.
- Fix: Use HTTPS everywhere. Encrypt sensitive database columns. Never log passwords, API keys, or credit card numbers. Use
password_hash()andpassword_verify().
8. Missing Rate Limiting
Without rate limiting, your login endpoint, API, and contact forms are vulnerable to brute force and spam.
- Fix: Implement rate limiting at the application level (track requests per IP per endpoint) and at the infrastructure level (nginx
limit_req_zone). Return429 Too Many Requestswith aRetry-Afterheader.
9. File Upload Vulnerabilities
Allowing users to upload .php or .exe files that get executed on your server.
- Fix: Validate file MIME type (not just extension). Store uploads outside the web root. Rename files to random strings. Set a maximum file size. Scan for malware if possible.
10. Insufficient Logging and Monitoring
If you cannot detect a breach, you cannot respond to it. Many Indian SMBs discover breaches months later ÔÇö or never.
- Fix: Log all authentication events, authorization failures, input validation failures, and admin actions. Set up alerts for anomalies. Review logs weekly at minimum.
Conclusion
Security is not a feature you add at the end ÔÇö it is a practice you build into every line of code. Start with these ten fixes, and you will be ahead of 90% of web applications in the Indian market.
Concerned about your application's security? Request a security audit from our team.
