Oh, as for an example of what the PCI specification was designed to protect against, have a read of this Daily Worse Than Failure article: http://thedailywtf.com/Articles/MUMPS-Madness.aspx (just disregard the extension, as if any REAL web server needs extensions! pheh!)