3 ms·If string is unescaped user input, then yes, you are.by john_reel 10y agoIf string is unescaped user input, then yes, you are.