1. A method, executing on hardware, for implementing security in a web application, wherein the web application is executed in a web application language execution environment within a web server, the method comprising: establishing at least one inbound tagging rule for tagging objects entering the web application language execution environment, referred to as inbound objects, according to a respective source of each of the inbound objects; assigning a tag to at least one of the inbound objects being operated on by the web application language execution environment based on the at least one inbound tagging rule; establishing at least one security rule for performing security actions on at least one object that is outbound from the web application language execution environment, referred to as outbound objects, according to a respective tag of each of the outbound objects; and performing a security action on the at least one outbound object being operated on by the web application language execution environment based on the at least one security rule, wherein the detection of the attack comprises a lexical analysis of the data of the object being operated on by the web application language execution environment checking the tags assigned to the outbound object.