http://code-security.net/archives/114#comment-63