Top 25 most dangerous mistakes in software development

Once a year, the CWE and SANS Institute publish a study into the 25 most commonly made programming mistakes that can, ultimately, lead to critical vulnerabilities in software. In this year's "Top 25 Most Dangerous Software Errors" the top of the bottom of the pile is SQL injection, which is the result of unfiltered or poorly filtered parameters.

Using SQL injection, an attacker can often get access to an entire system's data, which can lead to massive information leaks. SQL injection attacks were, along with DDoS attacks, a favourite of the recently disbanded LulzSec and allowed them to release large numbers of user records and passwords, both in plain text and encrypted; as users often use the same password on different systems, those passwords can be the key to other systems too.

In the number two position came OS command injection, which is when unfiltered parameters are used as part of a command to be executed by the underlying operating system. Still in the top three, classic buffer overflows, described as "still pernicious after all these decades", came in third thanks to their ability to allow code to be injected into running applications.