CVE-2026-31952: Incomplete Sql Keyword Blocklist Bypasscve-2026-31952-incomplete-sql-keyword-blocklist-bypass
Using `str_replace` or `str_ireplace` with an empty string to sanitize input based on a blocklist is unsafe. Attackers can bypass this by nesting blocklisted words (e.g., 'SELSELECTECT') or using mixed casing. Use a robust sanitization library or parameterized queries instead.
