They used to publish vulnerable code as examples without any context. For example... XSS: https://web.archive.org/web/20060722051641/http://www.w3schools.com/p

They used to publish vulnerable code as examples without any context. For example... XSS: https://web.archive.org/web/20060722051641/http://www.w3schools.com/php/php_forms.asp https://web.archive.org/web/20060722051641/http://www.w3scho... / https://web.archive.org/web/20060722073110/http://www.w3schools.com/php/php_post.asp https://web.archive.org/web/20060722073110/http://www.w3scho... / https://web.archive.org/web/20060722072840/http://www.w3schools.com/php/php_get.asp https://web.archive.org/web/20060722072840/http://www.w3scho... Unauthenticated sessions: https://web.archive.org/web/20060716141638/http://www.w3schools.com/php/php_cookies.asp https://web.archive.org/web/20060716141638/http://www.w3scho... MySQL injection: https://web.archive.org/web/20110412041949/http://www.w3schools.com/php/php_mysql_insert.asp https://web.archive.org/web/20110412041949/http://www.w3scho... Nothing directly wrong with this one but prepared queries were not well understood at the time: https://web.archive.org/web/20060718041049/http://www.w3schools.com/php/func_mysql_query.asp https://web.archive.org/web/20060718041049/http://www.w3scho... They were very easy to learn from and thus widely popular, but missed critical security context.