// CRITICAL: Direct variable interpolation
$query = "SELECT * FROM users WHERE id = $id";
$query = "SELECT * FROM users WHERE email = '$email'";

// CRITICAL: Concatenation
$query = "SELECT * FROM users WHERE name = '" . $name . "'";
$query = 'SELECT * FROM users WHERE status = ' . $status;

// CRITICAL: sprintf without validation
$query = sprintf("SELECT * FROM users WHERE id = %d", $id); // Still risky if $id is user input

// CRITICAL: Direct from request
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];
$query = "DELETE FROM posts WHERE id = " . $request->get('id');

// CRITICAL: In method parameters
public function findByEmail(string $email): ?User
{
    return $this->query("SELECT * FROM users WHERE email = '$email'");
}

// CRITICAL: User-controlled table name
$table = $_GET['table'];
$query = "SELECT * FROM $table";

// CRITICAL: User-controlled column
$column = $request->get('sort');
$query = "SELECT * FROM users ORDER BY $column";

// CRITICAL: User-controlled field in WHERE
$field = $request->get('field');
$query = "SELECT * FROM users WHERE $field = ?";

// CRITICAL: Direct query execution
$pdo->query("SELECT * FROM users WHERE id = $id");
$mysqli->query("DELETE FROM posts WHERE id = $id");

// CRITICAL: exec() usage
$pdo->exec("UPDATE users SET status = '$status' WHERE id = $id");

// CRITICAL: Doctrine DQL injection
$dql = "SELECT u FROM User u WHERE u.email = '$email'";
$query = $em->createQuery($dql);

// CRITICAL: Query builder with raw
$qb->where("u.status = $status"); // Raw expression

// CRITICAL: Native query without binding
$sql = "SELECT * FROM users WHERE name LIKE '%$search%'";
$em->getConnection()->executeQuery($sql);

// CRITICAL: Unescaped LIKE
$query = "SELECT * FROM products WHERE name LIKE '%$search%'";

// WARNING: LIKE wildcards not escaped
$stmt = $pdo->prepare("SELECT * FROM products WHERE name LIKE ?");
$stmt->execute(["%$search%"]); // $search may contain % or _

// CRITICAL: Building IN clause unsafely
$ids = implode(',', $_GET['ids']);
$query = "SELECT * FROM users WHERE id IN ($ids)";

// WARNING: Even with array_map, still risky
$ids = array_map('intval', $_GET['ids']); // What if empty?
$query = "SELECT * FROM users WHERE id IN (" . implode(',', $ids) . ")";

// CRITICAL: Unparameterized stored procedure
$query = "CALL process_order($orderId, '$status')";
$pdo->query($query);

# Variable in SQL string
Grep: '"\s*SELECT.*\$\w+|"\s*INSERT.*\$\w+|"\s*UPDATE.*\$\w+|"\s*DELETE.*\$\w+' --glob "**/*.php"

# Concatenation in query
Grep: "query\([^)]*\.\s*\\\$" --glob "**/*.php"

# Direct $_GET/$_POST in query
Grep: '\$_(GET|POST|REQUEST)\[[^]]+\].*query' --glob "**/*.php"

# exec() with variable
Grep: "->exec\([^)]*\\\$" --glob "**/*.php"

# DQL with variable
Grep: "createQuery\([^)]*\\\$" --glob "**/*.php"

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);

// Named parameters
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);

$qb = $em->createQueryBuilder()
    ->select('u')
    ->from(User::class, 'u')
    ->where('u.email = :email')
    ->setParameter('email', $email);

$allowedColumns = ['name', 'email', 'created_at'];
$column = in_array($sort, $allowedColumns, true) ? $sort : 'id';
$query = "SELECT * FROM users ORDER BY $column";

$search = addcslashes($search, '%_');
$stmt = $pdo->prepare('SELECT * FROM products WHERE name LIKE ?');
$stmt->execute(["%$search%"]);

### SQL Injection: [Description]

**Severity:** 🔴 Critical
**Location:** `file.php:line`
**Type:** [Concatenation|Dynamic Table|Unescaped Input|...]

**Issue:**
User input is included in SQL query without proper parameterization.

**Code:**
```php
// Vulnerable code

// Parameterized query