|
Thing is, he didn't exploit a hole. He used functionality that is provided as a favor to most of us to trick people into running his code. GFY could easily turn off html posting, which would suck for people who use it to format their sigs, but they leave it on to help us out. Writing code to go through and parse out any html that could be used to trick people into posting things they didn't mean to would be time consuming and a pain in the ass.
|