... and sub-theme

• Developers often assume, incorrectly, that input to their web applications always comes from browsers

• • It is trivial to generate HTTP from programs
  • Javascript validation is only useful as a help to the user. It does not provide any server-side protection