Which Place Can An Attacker Inject Code