Testing for Code Injection