Cross Site Scripting SQL injection String cut attacks include() and eval()