Edit: I forgot to add: The systems they are using are mainly completely outdated systems and there is almost only string concatenation for request building, did

Edit: I forgot to add: The systems they are using are mainly completely outdated systems and there is almost only string concatenation for request building, didn't see any prepared statements.