Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

Affected: Packagist: flightphp/core

### Summary `SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. `$db->insert('users', $request->data->getData())` — an attacker can inject arbitrary SQL by crafting malicious array keys.

### Affected code `flight/database/SimplePdo.php`:

```php // insert (≈ 320-373) $sql = sprintf( "INSERT INTO %s (%s) VALUES (%s)", $table, // raw concat implode(', ', $columns), // raw array_keys($data) implode(', ', $placeholders) );

// update (≈ 397-409) $sets[] = "$column = ?"; // $column = user-controlled key $sql = sprintf( "UPDATE %s SET %s WHERE %s", $table, // raw implode(', ', $sets), $where );

// delete (≈ 427-429) $sql = "DELETE FROM $table WHERE $where"; ```

No identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.

### Proof of concept A controller does: ```php $db->insert('users', $request->data->getData()); ```

The attacker sends the JSON body: ```json {"name, is_admin) VALUES (?, 1);-- ": "attacker_injected"} ```

Generated SQL: ```sql INSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?) ```…