April 22, 2009 - 17:28 CEST "That does not mean, however, that blocking < and > when ouputting user data in javascript isn't necessary", David said.
[...]

March 10, 2009 - 20:02 CET David grabbed the keyboard and jotted down two new examples.
[...]

March 10, 2009 - 19:36 CET When I came into the office the next day, I immediately started rewriting the application to use prepared statements. An hour later I was done, and called Mr. X to go through it. By lunch time we had co-written the documentation, and code and documentation was sent over to the customer.
[...]