anchor.diff:  /**/ORIG
   ----
   
  +If the attack vector is in POST (HTTP body), try each of the above with and without URL encoding. For GET (HTTP URL), just use URL encoding.
positive.code: "=
  ----
  
  == SQLu
  
  The old SQL tests:
  
  [source]
  ----
  'BREAK\"
          
  OR 41=41
  ' OR '41'='41
  
negative.code: <p>"
  ----
  
  Both of the above will be sent like written above. The 2nd, unencoded version will be not exploitable in real life if the parameter is in GET (HTTP URL).
  
  For tag value based injection:
  
  [source]
  