It's programmers who think "oh.. cookies.. those are secure.. no need to worry about checking them for security" that leave big friggen secuirty gaps in their programs..
Cookies aren't secure by default.. You have to write your app to make them that way.. You can't just dismiss them as nothing..
Any time you are taking user information and store it some where you should look at the security of it all.. Databases can be just as insecure if your app isn't written right..
For example.. you might not strip special chars off a search form and a user could figure out a way to write code that does a select statement on the user_info table and prints it out to the screen... who knows?!?!?!
------------------------------------------------
Jeremy 'PeelBoy' Amberg
