Code from my X-Wow-Security-Header talk
Add CSP report-uri
Add HSTS example
Remove param copy
Adding SQLI examples
Adding session stealing script for XSS
Add correct escaping for mysql function and PDO examples
Add config template
Add a warning, it's vulnerable code inside
Database