The main security problem with all websites is how strings of characters are handled.

Once you have a good understanding of strings, then you can cover some of the finer points of web security: