How do start-ups deal with (black hat) hackers?
noodle: rule of thumb: sanitize your inputs.if you do this correctly and thoroughly, you're better off than like 70% of the web apps out there.  doesn't take much time, just requires that you set up everything and remember to do it for everything from GET/POST to cookies to manipulating the DOM.edit to clarify, based on child comments:sanitizing inputs doesn't necessarily mean you apply one filter to everything.  it just means that you're ensuring that what you're taking in from the app is something your code is expecting and can handle.  if you're expecting a sql query or some unescaped html, you don't need to filter out the query or the html.