PHP is a popular server scripting language for creating dynamic web page content. While writing applications can be relatively easy, avoiding security holes can be difficult. In an attempt to help improve PHP application security, Wietse proposed to add run-time support for tainted variables in December 2006, and released a first implementation in November 2007. With a run-time overhead of only 1-2%, permanent deployment becomes a realistic option. Wietse will show how his taint support works, and how it can help programmers to eliminate vulnerabilities such as Cross-site scripting, SQL injection, Shell command injection, Remote file inclusion, and more.