Change this code to not construct SQL queries directly from user-controlled data. (CWE-20)

[zisanyavuz]

A high severity vulnerability has been discovered in your project.

Project Name: sonarqube-1

Scanner Name: sonarqube

Cwe ID: 20

Cwe Name: Improper Input Validation

Cwe Link: https://cwe.mitre.org/data/definitions/20.html

File: forgotusername.php

Line: 12

Code:

        $ret = pg_query($db, "select * from users where username='".$username."';");

Language: php

Tool Description: Change this code to not construct SQL queries directly from user-controlled data.

Custom Description: test

Kondukto Link: http://10.20.104.4/projects/65c0e0844d94d54eabbd983e/vulns/appsec?page=1&perPage=15&id=in:65c0e2d9243feaacc254c03b
Deeplink: http://10.20.104.48:9000/project/issues?types=VULNERABILITY&open=AYzyN3i7Tftj40din2Pu&id=php-tudo