Innocent Code: A Security Wake-Up Call for Web Programmers