<html>
<! Attack.php                                                 >
<! Chapter 10, Oracle Database XE PHP Web Programming         >
<! by Michael McLaughlin                                      >
<!                                                            >
<! This script demonstrates an insertion attack               >
<! vulunerability.                                            >
<head>
<title>
  Chapter 10 : Attack.php
</title>
</head>
<body>
<?php
  // Assign an unfiltered parameter.
  $any_var = $_GET['p_name'];

  // Open a hole.
  eval($any_var);
?>
</body>
</html>
