Since we are discussing software security, this is a good time to mention cross site scripting (XSS) and SQL injection. As you probably know XSS and SQL injection both rely on "injecting" code into a web application, but it is the flaws in the software (browser or database) that allow the attack to function. Has anyone dealt with either, or been at a victim company? What are some good practices to prevent these attacks?