title: Can an attacker take advantage of HTML tag injection in request parameters?
body: <p>Say I have a web application that accepts a parameter called "content". Whatever is present in this parameter will be output as a part of the HTML response.</p>
  
  <p>Example JSP code:</p>
  
  <pre><code>&lt;%= request.getParameter("content") %&gt;
  </code></pre>
  
  <p>I know this is silly and it should be sanitized and so on, but my question is if an attacker can actually take advantage of this? The way I understand it you'd only change the content sent to yourself, so the only one an attacker could hurt is himself? Correct?</p>