> "Mistake #3: Unescaped SQL query..."
This should be "failure to use parameterised queries." The term 'unescaped' may lead some to think that simply escaping characters is sufficient.
This should be "failure to use parameterised queries." The term 'unescaped' may lead some to think that simply escaping characters is sufficient.
Without placeholders the risk is way, way too high. A single mistake can be the end of your entire application if not career.
Don't think "Oh, this is just test code, I'll fix it later" and leave a vulnerability in your application. Always write using placeholders. No exceptions.
The problem is not that this query was not escaped, the problem was that: 1) unparametrized queries are allowed in code, 2) user input is obviously not properly checked in all cases and 3) that WAF (Web Application Firewall) was not used / set up properly.
Other than that, thanks to OP for in-depth writeup - it helps to be reminded from time to time why security matters.
I would trust parameters much more (although I have used proper escaping in the past).