Security has become the limiting reagent in the broad adoption of web services. As a result, much emphasis has been placed on the development of various high-level security standards and protocols, but in most cases the simplest attacks, those at the application level, have been neglected.