Developer's Guide to Web Application Security

Q: My company doesn’t have any programmers, but we use many commercial Web-

based applications. Are these safer? If not, how can I learn about their flaws?

A: Unfortunately, you can’t assume that a program written by someone else is any

better than one you’d write yourself. If you are lucky enough to have access to

the source code for a program you are purchasing, as is the case with Perl, PHP,

and other scripted languages, you can examine this source code for errors. As

always, if you don’t have the necessary experience, you can hire a respected

auditor to help you.You can also find many repositories of known vulnerabili-

ties, with one of the best being ...