"piping commands directly to a site's back end"

That can be nasty!!

but don't they teach you to sanitize your data on pretty much day one of the "how to write web applications" class ?

What little I know says that's the first thing you check for (and I'm self taught)

And for every web app I've had written for clients gets sent off for pen tested by a very nice company I know for a "proper" go at breaking it

Seems the bright thing to do <shrugz> though like I said Im self taught but like keeping my customers so what do I know ?

Ohh and PLEASE dont post that XKCD cartoon again - we have all see in about 30 times now and get the joke

Kev

Paris as she knows the trouble a decent penetration can cause ;)

There'll be no piping without permission!

Take it you know 100% that these are offshored?

And what about the 2/3's of websites that have XSS issues are all these offshored?

...there are other culprits:

:: "programmers" who are hired out of the call centres because they've written a "hello world" website and so management think they must be whizzkids;

:: self-taught coders who never read a security blog or articles teaching them how to better their code so they drift along thinking they're good at their job;

:: companies who don't enforce peer review either through lack of time, or incompetence.

:: contractors who are in it for the quick buck or speedy solution (disclaimer: I am a contractor but I am not a cowboy)

:: sign-off departments who only test if something works (in IE6), not how it works if you try to break it using devious methods.

Sadly, coding for prevention takes time and businesses are loathe to spend the monies required to take the time to do a job properly, or hire the right people for the job.

Which you've all seen a million times on thedailywtf.

which xkcd cartoon would that be then? Care to post a link?

*ducks shoe thrown by Kev K*