All three come from mixing untrusted input into a trusted context. Stop SQL injection with parameterized queries, never string concatenation. Stop XSS with contextual output encoding, avoiding raw HTML injection, sanitizing any HTML you must render, and a strict Content Security Policy. Stop CSRF with SameSite cookies plus a per session token on state changing requests, or a custom header that a cross site form cannot set.
Why interviewers ask this
These are the bugs that get products breached, so the interviewer wants baseline competence plus a sense of defense in depth. They are listening for whether you name the mechanism rather than a library, whether you know CSRF only matters for cookie based auth, and whether you treat validation and encoding as different jobs. A candidate who says they sanitize all input is usually missing the context part.
How to structure your answer
- Frame all three as untrusted data reaching a trusted context.
- Give the primary defense for each in one line.
- Add a second layer for at least one of them.
- Mention where framework defaults already protect you.
Example answer
I think of them as one shape: data from a user ends up somewhere it gets interpreted. For SQL, the interpreter is the database, so parameterized queries or a query builder that binds values solve it completely, and there is no acceptable reason to concatenate a string. For XSS, the interpreter is the browser, and the key point is that escaping is context dependent. React escapes text nodes for you, so the risk concentrates in the escape hatches: raw HTML injection, href values that could be a javascript URL, and anything written straight into the DOM. Where a product genuinely needs user HTML, like a rich text field, I sanitize with an allowlist library server side and add a strict CSP as the second layer so a miss is not automatically an account takeover. CSRF only applies when the browser attaches credentials automatically, so SameSite set to Lax kills most of it, and I still add a per session token on anything that changes state. Cookies get httpOnly and Secure as a matter of course.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- Where does SameSite Lax still leave you exposed?
- What is the difference between stored, reflected and DOM based XSS?
- How would you roll out a Content Security Policy on an existing app?
Related full stack developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions