xml approach
injection mapping: tainted vars - query - response