@mttaggart specifically php - i cant say - but, like, clearly yes - otherwise why would xss be 'the worst' right now?