Defining and Preventing Code-injection Attacks