I encountered a novel (to me anyway) form of injection attack in one of my logs
login as <!--#exec cmd="ls .."-->
Which looks like someone it trying to trigger sever side includes on an apache server, if the input text was echoed into an error message.
Can apache even be configured to process SSI on it's output stream? Or is there some more subtle vulnerability it's trying to exploit?