Many companies are under the impression that testing for Web application security simply involves a cursory check for easy-to-guess usernames and passwords. Yet application security testing can and should involve more complex checks, such as testing for SQL injection and Cross-Site Scripting. Often this sort of review does not happen until the Web application is in production, when it is too late to stop a hacker or a malicious program from attacking and much more expensive to remediate the vulnerability.

Quality assurance departments have traditionally focused on functional testing G