Language: PHP
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
            $dataArrayValuesQuotedImplode = implode(', ', array_values($data));
            
            $insert_query .= " VALUES  (" . $dataArrayValuesQuotedImplode . ")";
            
            $db->query($insert_query);
        }
    } else {