If they code Web applications with security in mind, many of these vulnerabilities won't exist in the final application. Most of these exploits rely on the application not checking the data being input by the user. Outside input should never be trusted and always checked. Additionally, a name field probably doesn't need 255 characters of input, which could let a malicious user create a buffer overflow on the system. When an application vulnerability is made public, it's usually just a matter of time before someone finds your site running a vulnerable application.
Several tools are available to help secure Web applications.
If your Web application uses CGI scripts, you should scan it with RFP's whisker.pl script. This Perl script scans a site for known CGI vulnerabilities. It protects Web sites from all the vulnerabilities discussed in this article. They also have a product, AppScan, that can be used to test applications for vulnerabilities. A few other products on the market help protect some Web application servers from attacks.