by far the most worrying thing I have ever seen is an online payment application that went something like this...

https://somewhere/payment.cgi?cardnumber=34523523453&surname=smith&add
+ress1=5%20street...
[download]

...going on to detail _all_ a customers details on the url. It was actually a customer who phoned up and pointed this out.

How they kept their jobs is beyond me.