#include<stdio.h>
     int main(int argc, char *argv[])
     {
     int i,j,k
     unsigned long acc=0;
     for(i=0;i<10000;i++)
          for(j=0;j<5000;j++)
                  for(k=0;k<4;k++)
                          acc+=k;
     printf("acc = %lu\n",acc);
     return 0;
     }

Really, if you’re preparing your code for publication, take the time and clean it up so it’s readable (hint: try pressing the space bar a bit more at a minimum). An editor won’t let bad spelling through into the article, so why does bad code get treated with such impunity?

No, it’s not.

XSS is a problem because we have dumb programmers using even dumber tools¹.

I’ve railed before about the fact that if you’re outputting HTML, then your tool should do HTML escaping for you by default.

It’s kind of understandable in systems like Template Toolkit, which are not specifically aimed at the web, but it’s completely inexcusable in PHP. It’s designed to create web pages. You’d think it’d be able to do it safely and easily. No chance.

But lest you think I rant at PHP, most other systems I’ve seen (in Java, Perl and Ruby) make it nearly as hard to do correctly. Let me rephrase:

If you have to think about where to apply escaping, then your tool is letting you down.

This isn’t to say XSS is the only problem. There are plenty of other problems to be aware of. CSRF appears to be garnering lots of attention these days.

One really useful link did come out of the Security Now show: OWASP (Open Web Application Security Project). It’s really worth checking out the OWASP Guide in order to educate yourself about security on the web.

¹ Before you start to feel offended about being called a “dumb programmer”, I most certainly include myself in this category too.