April 22, 2009 - 17:28 CEST "That does not mean, however, that blocking < and > when ouputting user data in javascript isn't necessary", David said.
[...]

March 10, 2009 - 20:02 CET David grabbed the keyboard and jotted down two new examples.
[...]

March 10, 2009 - 19:36 CET When I came into the office the next day, I immediately started rewriting the application to use prepared statements. An hour later I was done, and called Mr. X to go through it. By lunch time we had co-written the documentation, and code and documentation was sent over to the customer.
[...]

January 8, 2009 - 21:20 CET "As you saw from your implementation, writing your own security routines isn't always a good idea", Mr. X said looking me straight in the eyes.
[...]

January 5, 2009 - 22:15 CET I thought about what Mr. X said for a while.
[...]

January 4, 2009 - 15:21 CET "So let's go back to the input validation", Mr. X said. "How do you want to do the validation of the names now?"
[...]

January 4, 2009 - 14:17 CET "Now remember", Mr. X said, "that we are storing most of our user data in LDAP. But when we are storing orders, we store the name in our SQL database as a part of the shipping address. How do you suggest we handle LDAP injection with your approach?"
[...]

January 4, 2009 - 10:17 CET After finishing the call, Mr. X came back into my office.
[...]

January 3, 2009 - 11:39 CET The next morning I got my first go at a real system for a real customer. One of the company's clients had recently had a successful hacking attempt on one of their systems, and they wanted us to review and fix it.
[...]

December 8, 2008 - 21:09 CET Today was a disaster - I really messed it up.
[...]