Ok, so we're done playing nice. Maybe an attacker has decided a website has nothing of value to them, but they want to deny its functions to legitimate users nonetheless. Maybe they are after this application and want to bring it down and render the application owner helpless. Or worse yet, maybe they are just using this site to get to another one, and in compromising the application they hope to impact or laterally move to another. Whatever the motives, one class of injection attacks looks beyond convincing the application to cough up its secrets; they instead look to convince the server to run new code or execute commands that the application's developers had no intention of using or allowing.
We need to be able to find these attacks before the bad guys do. Data leakage is a huge concern, no doubt, but a complete...