IIRC, a year or two back, this very problem in PHP was bandied about quite a bit in
2600 Magazine. Although most of the h@xor kiddies had some pretty funny ideas about what PHP actually was (there was a popular notion, again IIRC, that it was some sort of throwback automated phonebook or address book application-- I think this was entirely based on the fact the
PHP and
phone both start with
PH) folks were pretty knowledgable in
how to exploit it, even if they weren't clear
what they were exploiting.
Just food for though, I guess.
The Autonomic Pilot; it's FunkyTown, babe.