In my experience it never, ever, ever, ever, ever has been that they didn't _know better_ but rather it was a time/money issue. Someone makes a page that needs

In my experience it never, ever, ever, ever, ever has been that they didn't _know better_ but rather it was a time/money issue. Someone makes a page that needs to be used by two or three people only and doesn't bother to secure it because it is quick and dirty project done that afternoon. The developer throws the project together and pushes it out. Then 18 months later it is exploited :-/