A demonstration is usually the way to go. Unfortunately, you also have to be careful, since demonstrating a security breach is usually technically breach of contract (or worse, since you actually are 'misusing' computer systems).
I would suggest that you have a quiet word with $BOSS express your concerns, and ask for permission to prepare a demonstration. That way you don't get shot for crashing the server 'deliberately'
Point out to them that once the program leaves your system, you no longer have control over it, and therefore it cannot be trusted. It's essential that your server 'deals with' dodgy input. Some sort of shell escape is usually a 'good' demonstration. (Depends on what your program does of course.)
SQL injection I've also found to be scary enough to our DBA to convince him that yes, actually getting rid of semi-colons in input is a good thing (tm).

--
It's not pessimism if there is a worse option, it's not paranoia when they are and it's not cynicism when you're right.

In reply to Re: how could i make "them" understand that security IS important ? by Preceptor
in thread how could i make "them" understand that security IS important ? by iza

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.