In certain circumstances, such as when targeting a 404 page or a website running PHP, the payload can also be placed in the path. For a detailed explanation of the taint flow between sources and sinks ...