Abstract: SQL Injection (SQLi) and Cross-Site Scripting (XSS) persist as key security vulnerabilities in web applications, continuously featured in the OWASP Top 10. This research offers a thorough comparative investigation of these vulnerabilities by developing a dual-version PHP/MySQL web application-one designed to be vulnerable and the other safely implemented. The research illustrates SQL injection exploitation through authentication circumvention, UNION-based data retrieval, and Boolean-based blind injection methods, in addition to stored and reflected cross-site scripting assaults. The susceptible version utilizes insecure coding methodologies, such as string concatenation in SQL queries, unsanitized output, raw password storage, and absent access controls. The secure version employs prepared statements via PDO, output encoding with htmlspecialchars(), bcrypt for password hashing, session-based authentication, CSRF tokens, and extensive security headers. Experimental findings indicate that the secure implementation effectively neutralizes all exhibited attack avenues, attaining a 95% enhancement in security compared to the susceptible version. The automated testing suite, created with cURL and PHP, programmatically checks both versions, underscoring the significance of including security testing into the development lifecycle. This research offers pragmatic, evidence-based recommendations for developers creating secure PHP applications and enhances the scholarly discussion on online application security.