I was playing with OWASP Mutillidae II and in one page I've found a vulnerability. In the address bar I've wrote something like this:
127.0.0.1/.../?page=text-file-viewer.php/"><script>alert("test");</script>
The alert box pops up, but I don't understand why? I know what happen if I put this code in an input form, but I don't know what the address bar do! How does the address bar process the string that it gets? Why does my code work if I put it in the address bar?