SQLI pre-scan: 5 file(s), 8 finding(s)

== HIGH ==
src/legacy.php:2  [SQLI-QUERY-INTERP] query call built with php-interp — if any part is user-influenced this is injectable; use bound parameters
src/orders.ts:2  [SQLI-QUERY-INTERP] query call built with template-literal — if any part is user-influenced this is injectable; use bound parameters
src/orders.ts:9  [SQLI-RAW-UNSAFE] raw-SQL API receives concat-built text — these calls skip parameterization entirely
src/users.py:4  [SQLI-QUERY-INTERP] query call built with fstring — if any part is user-influenced this is injectable; use bound parameters
src/users.py:10  [SQLI-QUERY-INTERP] query call built with concat — if any part is user-influenced this is injectable; use bound parameters
== MEDIUM ==
src/sort.js:2  [SQLI-IDENT-INTERP] template-literal into identifier/order position — cannot be parameterized; must be allowlisted
== LOW ==
src/legacy.php:3  [SQLI-QUERY-INTERP] query call built with php-interp — if any part is user-influenced this is injectable; use bound parameters
tests/test_users.py:2  [SQLI-QUERY-INTERP] query call built with fstring — if any part is user-influenced this is injectable; use bound parameters

Pre-scan only: flags non-literal SQL construction at call sites. Confirm the source of the interpolated value before treating any flag as exploitable.