I'd argue that all code should be fairly defensive. Security flaws in the end are just bugs. And defensive programming helps reduce bugs. As for toy projects -

I'd argue that all code should be fairly defensive. Security flaws in the end are just bugs. And defensive programming helps reduce bugs. As for toy projects - you never know when your futzing around becomes a full blown product. Obviously, security is always a tradeoff. I'm not suggesting you implement 2 factor authentication for your wedding invite website. But it does always help to consider: 1. How can this code break, if someone accidentally misuses it? 2. How can this code break, if someones intentionally misuses it? Very often, thinking about #2 can help resolve a lot of things overlooked in #1.