Security is really hard, you need everything perfect all the time. It's easy over look something, or just say "eh, no one will ever find it". It's hard to make sure a million or even 1,000 lines of code are 100% safe. Writing totally secure code takes much longer, much more skill.
No one can (or should) write totally secure code. But there are a lot of simple mistakes leading to XSS and SQLi that can easily be avoided by having some standards.
Comments
Security is really hard, you need everything perfect all the time. It's easy over look something, or just say "eh, no one will ever find it". It's hard to make sure a million or even 1,000 lines of code are 100% safe. Writing totally secure code takes much longer, much more skill.
No one can (or should) write totally secure code. But there are a lot of simple mistakes leading to XSS and SQLi that can easily be avoided by having some standards.