An attacker can modify the URL from: index.php?id=5 to index.php?id=5 UNION SELECT username, password FROM admins
Why? Because the web is full of templates and scaffolding. A PHP file that routes by id? A legacy CMS that uses “upd” as an action? A dev too busy to refactor? The result is the same: the site maps loudly and repeatedly to the same fragile interface.
