the attacker may explore the vulnerability by inserting format characters into the website