Hackers first check the application for attack surfaces that can take untrusted data and use it to execute program code. These include direct input such as file uploads, form fields, or other data sources such as cookies and query string parameters. Code injection usually consists of a natural character string concatenation, the PHP function eval(), or it's equivalent in another language. A successful exploit gives attackers access to the application's server interpreter.