Web application developers today need to be skilled in a multitude of disciplines. Itâ€™s necessary to build an application that is user friendly, highly performant, accessible and secure, all while executing partially in an untrusted environment that you, the developer, have no control over. I speak, of course, about the User Agent. Most commonly seen in the form of a web browser, but in reality, one never really knows whatâ€™s on the other end of the HTTP connection. There are many things to worry about when it comes to security on the Web. Is your site protected against denial of service attacks? Is your user data safe? Can your users be tricked into doing things they would not normally do? Is it possible for an attacker to pollute your database with fake data? Is it possible for an attacker to gain unauthorized access to restricted parts of your site? Unfortunately, unless weâ€™re careful with the code we write, the answer to these questions can often be one weâ€™d rather not hear. Weâ€™ll skip over denial of service attacks in this article, but take a close look at the other issues. To be more conformant with standard terminology, weâ€™ll talk about Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Phishing, Shell injection and SQL injection. Weâ€™ll also assume PHP as the language of development, but the problems apply regardless of language, and solutions will be similar in other languages.