Was that code actually embedded in a physical file? As in, it wasn't pulled from the database, or elesewhere such as that. To actually write to the file would require a different type of attack than a simple submit via a form.

__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.