HTML Sanitisation: The Devil's In The Details (And The Vulnerabilities) - Maugrim The Reaper's Blog
Threat Risk Modeling - OWASP
Graudit - Just Another Hacker
Ralph Schindler - Dynamic Assertions for Zend_Acl in ZF
ratproxy - Google Code
owasp-esapi-php - Google Code