Brett_Tabke - 2:42 pm on Mar 4, 2010 (gmt 0)

First off - fascinating document - worth a read by every programmer and is not PHP specific.

> Improper Input Validation

Agreed, tainted variables are the single most important issue for programmers today. It is the number one way that servers get compromised. It is how 90% of all malware ends up on servers. That happens through any method that code can be injected into the system. The list is long, but the big offenders are; MYSQL injection and system level params being passed to ultimately launch shell processes. One famous forum recently suffered a major error because people were able to upload graphic files with arbitrary filenames. Those filenames were injected with system level commands and executed by the forum itself when saving the file.

> Improper Encoding or Escaping of Output
> This isn't as big of an issue IMO than some of the other ones in there

Oh, there are quite a few cross site scripting errors out there that exploit unescaped form values. Go read the full article. It talks about a couple encoding errors that lead to injection attacks.