* Both PHP teams I checked (6,7) used SQL statements in the code. The
other teams don't seem to be doing this.

* Team7 uses template filtering methods (strip_tags, from SmartyPants)
to prevent html code injection. Don't know if this is safe.
