SQL Injection as a Feature
Over ten years, the legacy report page mutated from a locked-downSQLform. It ended up as a hidden console spilling raw database guts. Developers swapped hardcoded queries fordatabase-drivenreport names. They slapped ontimeouts,string filters, and warnings but skipped restoring safe defaults. Implic..