Raw SQL Injection Risk (ARCH7055)

Key php.orm.raw-sql-injection-risk · Severity error · Category orm

Building raw SQL via string interpolation/concatenation instead of bound parameters is both a SQL injection vector and a query-plan-cache buster. Always bind variable values as parameters.

Incorrect

<?php
$email = $_GET['email'];
$users = DB::select("SELECT * FROM users WHERE email = '$email'");

Correct

<?php
$email = $_GET['email'];
$users = DB::select(
    'SELECT * FROM users WHERE email = ?',
    [$email]
);

Fix

Never embed user input into SQL; use bound parameters (? / named).