Web applications share a few classic vulnerabilities that come from handling input carelessly. SQLi happens when input is built directly into a SQL statement, so input like ' OR '1'='1' can rewrite the search condition. XSS happens when input is written into a page without escaping, so a <script> tag runs as-is. CSRF abuses the fact that a logged-in session is sent automatically, making the browser fire a request the user never intended from another site. The fix differs per vulnerability — placeholders for SQLi, HTML-escaping on output for XSS, and token verification for CSRF.