Detected SQL query built by string concatenation with user input, which may allow SQL injection.
Use parameterized queries or prepared statements instead of string concatenation.