No, the simplest (but far from the only) example is DNS injection.