The Classics, and How They Return

Your framework handles these. Here is how each protection gets switched off.

SQL injection. The ORM parameterises. It returns via raw SQL built by string formatting.

XSS. Templates escape. It returns via a |safe filter, mark_safe, or dangerouslySetInnerHTML on user content.

CSRF. The token protects state-changing requests. It returns via @csrf_exempt, usually applied to silence an error rather than solve one.

Clickjacking. Middleware sets the header. It returns by removing it for an embed and never putting it back.

Three more worth knowing.

Insecure direct object reference, which is the authorization bug from module 1: the record id in the URL with no ownership check.

Mass assignment, where a form or serializer accepts every field and somebody sets is_staff on themselves. Name your fields explicitly.

Enumeration, where a different response for an existing and a non-existing account lets somebody discover who has an account. Same response, same timing.