Inurl View.shtml Hotel Rooms ^new^

Avoid passing user-supplied parameters directly to SSI directives. Use allowlists for room IDs or dates.

If you are reading this and you own a hotel: inurl view.shtml hotel rooms