It was 1999, I was a freshman at university, doing my first internship at a small hosting company. I was asked to develop a live web analytics tool that the company could offer to their customers. I made a 1px transparent image in PHP that logged the IP, referrer, user-agent, etc. in mySQL and showed the live stats in a nice table in the backend with the list of 50 last visitors.

This was one of my first projects in PHP and I naively did not know about never trusting user input and htmlentities().

Queue a couple of weeks later, I get a frantic call from my manager in the middle of the night. One of the customers is making a huge scene that someone hacked his website to put pornography on it. It turns out someone had changed their user-agent to <img src="http://goatse.cx/hello.jpg"> and visited one of our websites...