I don't know Java well, but at least in .NET it's possible to set a flag that disable execution of dynamically emitted code. Obvs, you should do this on every

I don't know Java well, but at least in .NET it's possible to set a flag that disable execution of dynamically emitted code. Obvs, you should do this on every box that accepts connections from the outside world. Obvs, it's no easier to get people to do this in practice than it is to get people to quit using string formatting to get parameters into their SQL queries.