Well, after about 2 years of PHP programming (and before that many other programming languages) I still time to time feel like a complete newbie when in comes to securing output when it comes to PHP. ;D
For instance today I just wanted to see what would happen if I typed home would do to my CMS that I am developing for my own website. An low and behold it kind of farted out on me big time and that was just a stupid anchor tag, I can just image what a true hacker could had to my website (even though I do use PDO prepare statements). Anyways, for God knows why I wasn’t securing the output and I was having some kind of brain fart trying to solve the problem. Anyways, It could have been too much Turkey for it’s Thanksgiving here in the United States or someone upstairs telling me to be more understanding to newcomers who are learning PHP. :
Spent 4 hours fixing something that I know almost like the back of my hands, but it goes to show that it pays to test your website out for vulnerabilities by seeing what would happen if you do this or if you do that. Moral of the story is never trust output that a user can change either by direct input or vial a url. The best way to do that is to escape (securing) the [size=14pt]output[/size] results. 