Such guides have long been available, but the masses don't care to read them. Form mail exploits have been a known problem for decades; no new education should be necessary. The Biblical "commandment" for this particular issue is "Never trust the client/Always sanitize your inputs". This would be basic knowledge to anyone competent in the field, including the managers overseeing the development. In truth, there are no less than 10 people in the FBI who could have and should have stopped this exploit before it ever went live. Odds are pretty good that at least 2 of those people are so incompetent that they never should have been hired in the first place. This sort of thing always points to larger organizational issues like that, and simply having documented best practices doesn't mean there still isn't some MBA out there that thinks they can just ignore it, try to get away with cutting corners, and thus end up making the world an increasingly worse place. 298fbef2e415782fd7e0ab81034ea0326d6a057db040f84c3d097e802e085682