While many Web applications are written directly in PHP or mod_perl, there are many Web application frameworks which automate the process, by allowing the programmer to define a higher-level description of the program. In addition, there is potential for the development of applications on Internet Operating Systems, although currently there are not many viable platforms that fit this model.

The use of Web application frameworks can often reduce the number of errors in a program, both by making the code more simple, and by allowing one team to concentrate just on the framework. In applications which are exposed to constant hacking attempts on the Internet, security-related problems caused by errors in the program are a big issue.

As of 2006, Java remains one of the most common programming languages for writing web applications; this is especially true for Web based enterprise applications (usually referred to as enterprise Web applications). J2EE (a Java programming platform) provides several useful components (JavaServer Pages, servlets, client-side applets, Enterprise Java Beans, JDBC and several Web service technologies) for writing enterprise Web applications. As of 2006, J2EE remains the standard in this area.

The Web Application Security Consortium (WASC), CGI Security, and OWASP are projects developed with the intention of documenting how to avoid security problems in Web applications.