It's scary actually. It's become so easy for anyone to build a site/app, but most people are clueless when it comes to security. Even the basics, like validating and sanitizing inputs and outputs. Couple this with the "I have to release before my competitors do" mentality and you end up with a gaping hole that you can just walk through. If your site is big enough, you should hire an expert.