I put it down to training more than anything. I bet Tesco haven't offered any of their development staff a structured (possibly external) training course on web

I put it down to training more than anything. I bet Tesco haven't offered any of their development staff a structured (possibly external) training course on web security. While training your staff won't solve all your security problems, I still think it'll help mitigate a lot of them.