Actually, I'm very glad you posted this for it raised something that's been eating at my ethics for some time.

We're told many things about what were suppose to do regarding security:

• Use CGI
• -wT
• use strict
• fix paths
• avoid backticks
• untaint only the most minimally supported values
• Don't include unnecessary (and unencrypted) data (prices, passwords, etc) as hidden or cookie fields.

Yet, I can find few specific examples of supposedly secure scripts. I see many things that aren't, but I see few discussions of what actually works.

I mean, it may be one thing to know that MSA sucks or that SS's shopping carts are *insecure*, but where do we find examples that *are* secure?

Apologies for going a bit left field on you, but if you think about it...that's what I think I lot of us want to do. What common, simple, and *specific* things can we do to write scripts that won't keep us awake at nights, fretting about what we don't know? What's the difference between memes/CCP/STO vs. what actually works?

--f

Update: Added a couple of new items based on a later CB conversation.