MUST READ for web developers

[rdivilbiss]

Web Application Security Consortium (WASC) Web Application Security Statistics Project. http://webappsec.org/projects/statistics/

And the OWASP Top 10 http://www.owasp.org/images/e/e8/OWASP_Top_10_2007.pdf

[CrYpTiC_MauleR]

I don't see CSRF on the stats, it is even more widespread that XSS seeing almost every site suffers from it unless the developer took precautions to protect all HTTP requests by using checksum or requiring re-authentication for certain actions.