Second-order SQL injection through stored profile fields
A value that is escaped on insert but concatenated on later use is injectable when the app reads it back into a raw query.
A value that is escaped on insert but concatenated on later use is injectable when the app reads it back into a raw query.