It'd be fun to see some more of those guidelines - there doesn't actually seem to be *any* correct information in the wording of that particular one - the throwing in of 'cross site scripting' sounds like it was written in conjunction with some PHB's...:)