Web applications security principles are based on authentication, authorization, session management, database secure work and web browser secure work. Session combines authentication and authorization process, whilst databases represent inevitable part of modern Web applications which are available through Web browser. Web application attacks are possible on any part of its security principles. For each particular type of attack there are adequate protection methods and procedures. Furthermore, the key step that ought to be firstly executed when developing application is security integration within the web application development. In that manner, development time and money saving is assured and unsatisfactory approach of gap finding and correcting is avoided. Hereunder are also mentioned Microsoft’s Security Development Lifecycle and Comprehensive Lightweight Application Security Process by OWASP organization. Case study of brute-force attack points out a kind of automated attack, while application testing on SQL injection attack proves the rule that utilization of prepared statements represents a proper kind of defense for this type of attacks.