Selected Articles & Blog Posts

• Filter Input, Escape Output

  This modest post became a cornerstone of web app security.

• JavaScript and URLs

  In 2011, I wrote a post about the growing misuse of JavaScript that remains relevant today.

• Cross-Site Request Forgeries

  This was the first dedicated article on CSRF. One year earlier, Foiling Cross-Site Attacks covered both CSRF and XSS.

  Published by PHP Architect

• URL Sentences

  In 2008, I pioneered the concept of URL sentences with my friend Jon Tan. Two years later, I wrote this post about it.

• Brooklyn Beta Opening

  Before welcoming Viktoria Harrison to the stage at Brooklyn Beta, I shared these two lessons.

• My Amazon Anniversary

  In 2006, I discovered a critical security vulnerability in Amazon. One year later, I published this post about it.

• Web Fonts

  Before Typekit, Fontdeck, and Google Fonts, when the idea of web fonts was nascent, I wrote this post in an attempt to make sense of it all.

• 10 Advanced PHP Tips Revisited

  This was a professional rebuttal to an article on Smashing Magazine. Sean Coates and I go through each and every tip from the original article and either validate and clarify it, or refute it.

  Published by Smashing Magazine

• LeakedIn

  On the heels of the news that LinkedIn had leaked 6.5 million passwords, some friends and I made a site called LeakedIn to let you know if your password was one of them.