Those appear to be all exec/eval type bugs. Yes, if you do "eval($querystring)" you've got a problem in any language, including C.