Before starting this Ethernet project the author did of course some prototyping and then he noticed alreadythat UDP was not a problem with lots of space left on the atmega88. Therefore he was quite confident that TCP + HTTP will work. TCP/IP was invented more than 25 years ago. Todays microcontrollers provide almost the computing power a standard computer had at that time. No java or xml was used at that time. Things were done in smart and efficient ways.
As you can imagine this web-server code is written for a friendly environment. Don’t put it on the open internet. The code uses e.g the incoming packet to build from it the outgoing packet. An attacker who sends a mal formed IP packet might be able to confuse the TCP/IP stack. The code is verified with a lot of different browsers and a number of operating systems. It was tested Linux, BSD Unix, Win 98, Win XP, Mac OS-X with a number of different web browsers. It works very well but it was not tested agains atacks and destroy tests.