No input validation for one, possibility for SQL injection is another.