> Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test I'll resist the pot/kettle/colour

> Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test I'll resist the pot/kettle/colour connection here about plugging your own stuff on HN in a web app security thread. Agh, too late. On a more serious note, if all the Internet apps Matasano test are using parameterized queries then: a) Matasano never tests a MySQL-based app AND i) Matasano does very little web app testing these days OR ii) You're not quite telling us the truth Seriously, parameterized queries while being a best practice so to speak are not a one size fits all solution and is not something implemented by everyone. The amount of shonky development practices we come across at my unnamed and unplugged company far outweighs the instances of the security aware, certainly on the first, second and sometimes third time round. Today I'm testing a wordpress-based web app. A beer says that it's not using parameterized queries.