Do Not Trust Website Visitors There is no Holy Grail Safe Mode Input Filtering, XSS mod_security (does not solve anything for PHP) Security by Obscurity does not help