# Top 25 Most Dangerous Programming Mistakes **URL:** \ **Category:** blog\ **Created:** [January 12, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231 "2009-01-12T00:00:00Z")\ **Posts on this page:** 20\ **Page:** 4

**Author:** ![HB120](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/h/94ad74/32.png) [@HB120](https://discourse.codinghorror.com/u/HB120)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/61 "2009-01-14T00:00:00Z")

@Andrew I suppose you could be right, but many beginning programmers are searching the web for answers every day. Wouldn’t this be a good blog for them to stumble upon? Do a quick search on Google for yourself? This post shows up as #9… [http://www.google.com/search?q=programming+mistakes](http://www.google.com/search?q=programming+mistakes) I think you might be over estimating the skill of the readers of this blog. I doubt that Jeff has 122K subscribed expert developers (you can start by adding me to the non-expert list). Even then, an occasional reminder list like this never hurts. This list contains no brainers for some of us, but most of these security holes aren’t because a developer doesn’t know _HOW_ to defend against it, but instead that he doesn’t know that he even _NEEDS_ to defend against it. ---

**Author:** ![ChrisR](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/c/ecd19e/32.png) [@ChrisR](https://discourse.codinghorror.com/u/ChrisR)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/62 "2009-01-14T00:00:00Z")

21 specially true for .net apps, lol ---

**Author:** ![Mohit\_Nanda](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/m/6bbea6/32.png) [@Mohit\_Nanda](https://discourse.codinghorror.com/u/Mohit_Nanda)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/63 "2009-01-14T00:00:00Z")

Client-Side Enforcement of Server-Side Security I loved the sound of it. Plus yeah it is one of the major causes for security breaches. Damn all the sites that use only Javascript validations. ---

**Author:** ![Steve\_O40](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/s/7cd45c/32.png) [@Steve\_O40](https://discourse.codinghorror.com/u/Steve_O40)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/64 "2009-01-14T00:00:00Z")

@HB I don’t think that ANY blog, or most web resources for that matter, is a _good_ resource for a beginning programmer. Some may disagree, but I think that there is never the comprehensive knowledge gained from a good, peer reviewed, book on whatever topic it may be. This page is no different - however entertaining it may be. Long Live The Book. ---

**Author:** ![Steve](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/s/f19dbf/32.png) [@Steve](https://discourse.codinghorror.com/u/Steve)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/65 "2009-01-14T00:00:00Z")

You forgot one: Don’t divide by zero. The rapid climb to infinity (or descent into negative infinity) is a total bummer. ---

**Author:** ![Rob](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/r/838e76/32.png) [@Rob](https://discourse.codinghorror.com/u/Rob)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/66 "2009-01-14T00:00:00Z")

@Steve-O: Too many books have these mistakes in them, some because it adds too much code, some because they were just plain dumb and put them there. ---

**Author:** ![CB11](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/c/a88e4f/32.png) [@CB11](https://discourse.codinghorror.com/u/CB11)\ **Post date:** [January 14, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/67 "2009-01-14T00:00:00Z")

This list proves why coding for the web is far more complicated than desktop programming. ---

**Author:** ![Bimal](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/edb3f5/32.png) [@Bimal](https://discourse.codinghorror.com/u/Bimal)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/68 "2009-01-15T00:00:00Z")

Nice points for the UI developer. Worth good… thanks.. ---

**Author:** ![Phil](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/p/e95f7d/32.png) [@Phil](https://discourse.codinghorror.com/u/Phil)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/69 "2009-01-15T00:00:00Z")

It’s a bit more specific than the title suggests: the descriptions analyze these mistakes for security’s sake, not covering other aspects. Example: race conditions are dangerous for your application for a number of reasons even if you are running in a completely isolated environment. ---

**Author:** ![tomma](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/t/f0a364/32.png) [@tomma](https://discourse.codinghorror.com/u/tomma)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/70 "2009-01-15T00:00:00Z")

@frangiplasticator Well chief, yes I am scared… because I want to put wholesale fixed income banking on the net. Not some retail bull. Full on trading-floor-class execution capability. But a top 25 list of holes, essentially amounting to immaturity in the infrastructure, mean that I will stay with proprietary, hard coded shrink wrapped apps which give me the control I need. Wish it wasn’t so. ---

**Author:** ![frangiplastica1](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/f/9e8a1a/32.png) [@frangiplastica1](https://discourse.codinghorror.com/u/frangiplastica1)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/71 "2009-01-15T00:00:00Z")

@tomma what are you on about? Developing any real commercial application is hard, and no matter what you do, you need to take security into account. At the very least done do any boneheaded things. These rules aren’t only applicable to web apps. You sound like a scared bank employee that still thinking that ‘only if this web thing catches on we’ll create an internet banking site.’ Just remember, the only safe application is the one that doesn’t do anything. Security is as much about not doing the wrong thing as it is about doing the right thing. You don’t need to be perfect, just don’t do something stupid. ---

**Author:** ![AlexOD](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/a/b3f665/32.png) [@AlexOD](https://discourse.codinghorror.com/u/AlexOD)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/72 "2009-01-15T00:00:00Z")

I concur with Mark on Jan 13, after 20 years of programming I would put among the horrors and dangers things like 1. Setting output enable before output register is in known state. 2. Not using volatile keyword on hardware registers 3. Insufficient headroom between buffer full and buffer high water mark. 4. Improper debounce of key inputs 5. badly scaled ticker interrupts When you have 2Kbytes for code and less for RAM you start seeing a very different world. Alex ---

**Author:** ![Rulas](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/r/58956e/32.png) [@Rulas](https://discourse.codinghorror.com/u/Rulas)\ **Post date:** [January 15, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/73 "2009-01-15T00:00:00Z")

#1 apply for general sofware development… the others are focused on web developmnet…maybe the post’s title should be different. Good post! ---

**Author:** ![JakubN](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/j/9f8e36/32.png) [@JakubN](https://discourse.codinghorror.com/u/JakubN)\ **Post date:** [January 17, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/74 "2009-01-17T00:00:00Z")

Top 11 Reasons Why Top 10 (or Top 25) Lists Don’t Work by Gary McGraw [http://www.informit.com/articles/article.aspx?p=1322398](http://www.informit.com/articles/article.aspx?p=1322398) ---

**Author:** ![BM1](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/d9b06d/32.png) [@BM1](https://discourse.codinghorror.com/u/BM1)\ **Post date:** [January 17, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/75 "2009-01-17T00:00:00Z")

To me Javascript should only be used for non-security related web apps. Use PHP for security measures and include tons of validation. The PHP reference I have says to never trust the user’s imput. That’s what I go by. ---

**Author:** ![BM11](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/b3f665/32.png) [@BM11](https://discourse.codinghorror.com/u/BM11)\ **Post date:** [January 17, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/76 "2009-01-17T00:00:00Z")

You can take care of cookies problem by using IP verification or encrypting cookies forcing them through encrypted channels. ---

**Author:** ![Nicholas](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/n/4da419/32.png) [@Nicholas](https://discourse.codinghorror.com/u/Nicholas)\ **Post date:** [January 19, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/77 "2009-01-19T00:00:00Z")

I’ve added this in my bookmarks! Very nice top 25! Must read for all young developers :) ---

**Author:** ![Alex](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/a/db5fbb/32.png) [@Alex](https://discourse.codinghorror.com/u/Alex)\ **Post date:** [April 28, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/78 "2009-04-28T00:00:00Z")

One of the worst mistakes a _manager_ can do is to hire a sloppy developer who does not consider it his responsibility to write secure code. From my experience it’s pretty much black and white. If the developer is bad from the beginning don’t let him stick around, find a new one. Bad habits die hard. ---

**Author:** ![supras](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/s/a88e57/32.png) [@supras](https://discourse.codinghorror.com/u/supras)\ **Post date:** [July 29, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/79 "2009-07-29T00:00:00Z")

take care. in case more erros appear. ---

**Author:** ![Jon](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/j/3bc359/32.png) [@Jon](https://discourse.codinghorror.com/u/Jon)\ **Post date:** [February 6, 2010, 12:00am UTC](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231/80 "2010-02-06T00:00:00Z")

Nice list, but it’s mostly useless to me because I don’t program web pages that need to be secure. I think making the title specific, like 25 worst web security mistakes would have been better. [Previous page](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231.md?page=3) [Next page](https://discourse.codinghorror.com/t/top-25-most-dangerous-programming-mistakes/231.md?page=5)