"A slight feeling of disappointment... the 'attacks' listed are nothing new (we know eval() is evil), ... it's 2011 and people are still writing code like this.

"A slight feeling of disappointment... the 'attacks' listed are nothing new (we know eval() is evil), ... it's 2011 and people are still writing code like this." I'm not sure I understand this line of thinking? As you say, people are still writing code like this -- why shouldn't these problems be called out?