input : direct user input in string Xpath replace char sink : SQL query

input : direct user input in string Xpath replace char sink : SQL query

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : direct user input in string filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : direct user input in string filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : direct user input in string filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

input : shell commands filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

input : direct user input in string filtering : check if there is only numbers sink : SQL query

input : direct user input in string filtering : check if there is only numbers sink : SQL query

input : direct user input in string filtering : check if there is only numbers sink : SQL query

input : direct user input in string filtering : check if there is only numbers sink : SQL query

input : shell commands filtering : check if there is only numbers sink : SQL query

input : shell commands filtering : check if there is only numbers sink : SQL query

input : direct user input in string no filtering sink : SQL query

input : direct user input in string no filtering sink : SQL query

input : direct user input in string no filtering sink : SQL query