Raw/unparameterized SQL on user input (A03)

What it is

A SQL statement is assembled by string concatenation or template interpolation with a value that came from the request.

Why it matters

OWASP A03. The input becomes part of the statement rather than a value in it, so a crafted string can read other tables, drop them, or bypass the WHERE clause that was supposed to scope the query to one user.

How to fix it

Use parameterised queries — placeholders with a separate values array — for every request-derived value. Where the variable part is an identifier rather than a value, validate it against an allow-list of known column or table names.