How do you handle and prevent common security vulnerabilities like Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) in web applications?

To prevent XSS, you can sanitize user inputs, validate and sanitize data on the server-side, and use HTTPOnly cookies. For CSRF, you can use anti-CSRF tokens, validate requests on the server-side, and implement the SameSite attribute for cookies.