2) An important statistical gap with CSRF is reported; see Table 1
analysis.
3) PHP remote file inclusion (RFI) is #4 overall, not #5, and is
much closer to SQL injection in 2006 than originally reported.