php-pdo

SQL injection abusing PDO substitution in PHP Prepared Statement