Web App Sec ROI

In the same light as the Web App Sec Top Ten, does anyone know about any good studies or want to share their thoughts about the ROI of getting Web App Sec right in development ?

How much does it cost to fix a typical problem like XSS or SQL Injection ?

How much does it cost each company for each incident (I see $16K for a virus incident used often)?

How much does it cost to do a secure code review of a web app before release ?

etc, etc

-- 
Mark Curphey