From OWASP Top 10, which two categories are most relevant to code development?

• A. Cross-site Scripting and Path Traversal.
• B. Injection (SQL/NoSQL) and Broken Authentication/Session Management.
• C. Insecure Deserialization and Security Misconfiguration.
• D. Broken Access Control and Sensitive Data Exposure.

Answer: (B)

When you write software, the most direct risks come from how your code handles untrusted input and how it enforces authentication and session state. Injection vulnerabilities happen when code builds queries or commands by concatenating user-provided data, allowing attackers to alter the intended logic. The remedy is to use parameterized queries or prepared statements, validate input rigorously, and apply least-privilege access to databases. Broken Authentication and Session Management cover flaws in implementing login, password storage, session tokens, cookies, and logout flows. If these areas are weak, attackers can impersonate users or hijack sessions even with other security measures in place. Together, these two areas capture the coding tasks developers most directly influence during implementation. Other categories are still important—many arise from configuration, data handling, or authorization decisions—but the two above are most tightly tied to everyday code development.