Yeah, the problem today is that there are many guides on MVPing software which don't tell you basic security.

The guy doesn't have a software background.

This is basically the problem with the 'everyone-should-code' approach - a little knowledge can be dangerous.