How do you query your database? There is still a bunch of new PHP projects that use mysqli::query, which is like playing with fire compared to using PDO::prepare If you are still using mysqli, changing to PDO for future commits might help reduce chance of creating these kind of vulnerabilities.