One lock does not protect an entire house.
Doors, windows, alarms, and residents' habits have different roles. On the Web, validation, escaping, CSRF, sessions, headers, and rate limiting are complementary layers too.
Four questions before every feature
Who acts?
Anonymous visitor, signed-in user, or administrator?
What arrives?
Do values have the expected type, size, and shape?
What changes?
Does this action require identity, authorization, and CSRF?
What is revealed?
Does the response or log expose an internal secret?
Threat and protection are not synonyms
XSSescaping + CSP
CSRFform token + session
SQL injectionPDO parameters / DbSet
Session theftHTTPS + HttpOnly + Secure + SameSite
Automated abuserate limit + authentication + monitoring
VOCABULARY
Words to remember
ThreatEvent capable of causing harm.
VulnerabilityWeakness a threat can exploit.
AuthenticationVerify who a person is.
AuthorizationDecide what they may do.
SUMMARY
What to remember
- Security relies on multiple layers.
- Authentication and authorization differ.
- Input is validated; output is escaped.
- Public errors do not reveal internal details.