So let's calculate the current situation, we have (careless PHP programmers) + (careless web servers administrators) + (careless and clueless users) + (Google Search) = A losing security game and a winning hacker.

Take it from a security practitioner, don't leave any vulnerable web application to run on your systems. Do code auditing or if you have a huge deployment, try to get a web applications firewall, for example Mod_Sec for Apache. Also, users training and awareness is an added value.

http://extremesecurity.blogspot.com

Click to read the article this is in response to.