I started this discussion because of many security issues in some of vanilla's extensions including mysql-injection (see also brandocs post on the WhosOnline extension), actions users can perform (delete, edit rows from extension-specific tables) even if they are not logged in. i did a lot of rework on the plugins i use on my testing-site. the changes will be sent to the plugin-authors as soon as possible.

Another point is that some of plugin-authors don't seem to use the frameworks mighty functionalities... Many of the extensions are for use with MySQL only because they use native functions like "mysql_query". Better use the SqlBuilder instead, just to give an example.