>Most web apps are built in languages that don't have buffer overrun problems.

This is a very dangerous assumption. The interpreters you use have not been built with security in mind.

Go take a look at PHP changelogs for example.