A security review lists three findings: reflected XSS in a status p…

Question

A security review lists three findings: reflected XSS in a status page, CSRF on an admin POST, and SQLi in a search endpoint. Which pairing correctly matches each threat to its primary mitigation?

Accepted Answer

XSS → output encoding; CSRF → anti-CSRF token; SQLi → parameterized queries. — Right tool, right job: encode what you print (XSS), token what you change (CSRF), bind what you query (SQLi). Swapping those fixes leaves each hole open.

Answer

XSS → CSRF token; CSRF → bound SQL parameters; SQLi → HTML output encoding.

Answer

XSS → SameSite cookie only; CSRF → HTML encoding; SQLi → firewall allow-list of ports.

Answer

XSS → parameterized queries; CSRF → output encoding; SQLi → anti-CSRF token.

A security review lists three findings: reflected XSS in a status page, CSRF on an admin POST, and SQLi in a search endpoint. Which pairing correctly matches each threat to its primary mitigation?

Short Explanation

Full Explanation