not a web dev

but php code injection flaws tended to mean terminal prompt injection with little encouragement.