i heard that it is possible to exeute commands through <FORM>s
-is this true?
-does it only take HTML?
-how do you stop it?