PHP security

This is interesting:
http://blog.washingtonpost.com/securityfix/2006/03/when_macs_attack.html

Well, after a bit of digging and further research, as far as I can find, all of these security vulnerablilities have to do with unchecked input being passed to perl scripts (such as some stat logging scripts) or to eval() functions or to the database. It looks like the bottom line is careless programming; not validating data before using it.

I know I have been guilty of this, thinking that since my data is strictly internal data passed via a hidden input field for example that it must be safe. Well, now I know better. From now on, NOTHING gets used from GET, PUT, COOKIE or SESSION without data validation checks.

Funny you mention this.. I have been reading a bit about security since I had an important meeting yesterday with a potential client which is quite concerned about it. Validating input is among the top 7 php security blunders.

A very interresting article. Also a nice read is the MySQL counterpart : Securing MySQL: step-by-step

I wonder how we stand on all those ?