I'm no security expert by any means and I'm probably not aware of the severity of this issue, but: >> If I enter [script] As my username on your website, and y

I'm no security expert by any means and I'm probably not aware of the severity of this issue, but: >> If I enter [script] As my username on your website, and your website runs a script and sets TARGET_USER to my username, then I will install my rootkit on your web server. How contrived is this? I mean, who does this in the first place? Isn't this more an issue with weird authentication? Again, I'm probably ignorant how all of this works so if anyone could give a better explanation...