Test your Web-security knowledge with a free interactive quiz — 50 questions with answers and explanations. No signup needed to play.
Question 1/12Score 0
Output encoding (HTML-escaping) protects primarily against which class of attack?
In this round
Output encoding (HTML-escaping) protects primarily against which class of attack?
What is Cross-Site Request Forgery (CSRF) in one sentence?
What is OWASP?
```
const sql = `SELECT * FROM users WHERE email = '${req.body.email}'`
db.query(sql)
``` What vulnerability does this code have, and how do you fix it?
Why should you NOT store passwords using fast hashes like MD5 or SHA-256?
What security guarantees does HTTPS (HTTP over TLS) provide?
What does the "Same-Origin Policy" mean for web pages?
Why should authentication cookies be set with the `HttpOnly` attribute?
What is the correct approach to input validation on a server?
Which best captures the principle "don't trust the client"?
What is Cross-Site Scripting (XSS) in one sentence?
A site is served on both `http://` and `https://`. What should be done?