And yet bugs like this make it into production systems all the time. Several Rails security bugs have been almost as trivial and just as avoidable.