Have you ever had one of your sites get hacked?
jacquesm: yes.I run a filedump as part of all the stuff we do, one day some smart alec figured out that I had forgotten that if somebody uploaded a .php file that it would execute instead of being downloaded... Very very stupid of me.The next step was to upload a nice little backdoor filemanager package written in php and run it from the download directory (this must have been harsh because the url switches after every download). Eventually they got access to the password hashes, but since I found out about the hack within 24 hours I just changed the passwords on the system after plugging the hole.Obviously the way to handle that was to refuse files whose exension is .php.I still can't believe that it was that easy to get in, and I feel totally stupid for not having foreseen that.