The summary.
CHOOSE AN ESTABLISHED, WELL-DOCUMENTED FRAMEWORK
Answers exist when you are stuck. Novelty is a poor criterion.
THE SETTING THAT HAS EXPOSED THE MOST APPLICATIONS
Debug mode left on in production. It reveals paths, versions and sometimes credentials.
VALIDATE ON THE SERVER, ALWAYS
Browser validation is convenience, not security. It can be bypassed entirely.
THE THREE RULES THAT PREVENT MOST WEB VULNERABILITIES
Parameterise every database query. Escape everything displayed in a page. Enforce authorisation server-side on every protected route — hiding a link is not access control.
FOR PASSWORDS
Use an established password hashing function. Never write your own, and never store them in plain form.
Changing a password should end existing sessions.
DO NOT SERVE STATIC FILES THROUGH YOUR APPLICATION
The web server does it better, and it consumes application processes otherwise.
Version filenames so caching does not serve an old copy — that is why a stylesheet change appears not to take effect.
THE COMMONEST PERFORMANCE PROBLEM
Queries issued inside a loop, producing one query per item. Fetch what you need in one query.
RETURN THE CORRECT STATUS CODE
Returning success for a failure breaks everything downstream.
