Find the error in the code and the vulnerability (code with SQL concatenation via QueryBuilder)

An error in code with SQL concatenation via QueryBuilder is usually related to the developer manually concatenating SQL query strings, which leads to a vulnerability — SQL injection. Even if QueryBuilder is used, if parameters are inserted directly into the query string rather than through prepared statements or parameter binding methods, it is dangerous.

Example of vulnerable code:

$query = $queryBuilder->select('*')
    ->from('users')
    ->where("username = '" . $_GET['username'] . "'");

Here, the $_GET['username'] parameter is inserted directly, allowing an attacker to inject SQL code.

The correct approach is to use parameter binding:

$query = $queryBuilder->select('*')
    ->from('users')
    ->where('username = :username')
    ->setParameter('username', $_GET['username']);

Thus, the error is manual concatenation of parameters in the query, and the vulnerability is the possibility of SQL injection.