One comment: in the context of the sub GOOD { BAD } example: remember that this is about creating vulnerabilities in code, not, "DOY I CAN'T PROGRAM'. I think from that perspective, they have a point. Remember that creating vulnerabilities isn't about good programming practice, but of taking advantage of possible weaknesses.