It just feels like it's getting hammered into programmers' minds to never use unescaped strings in DB queries all the time. Quite hard to believe that a decent

It just feels like it's getting hammered into programmers' minds to never use unescaped strings in DB queries all the time. Quite hard to believe that a decent programmer would concat such raw output to an SQL string unescaped. Nevertheless I'm sure this happens all the time. The interesting thing about this report is how fast you can brute-force calculate this in order to find a magic byte sequence.