The most critical web application attack classes — SQL injection, XSS, broken access control, CSRF, and more — explained plainly with concrete defenses for each.