Audit SQL construction for concatenation and raw ORM
Parameterized queries are safe; string building and raw ORM escapes are where injection hides.
Tag: sqli
Second-order SQL injection through stored profile fields
A value that is escaped on insert but concatenated on later use is injectable when the app reads it back into a raw query.