Language: PHP
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public function inheritableSegments(Request $request, SegmentManagerInterface $segmentManager)
    {
        $id = $request->get('id') ?? '';
        $type = $request->get('type') ?? '';

        $db = \Pimcore\Db::get();
        $parentIdStatement = sprintf('SELECT `%s` FROM `%s` WHERE `%s` = :value', $type === 'object' ? 'o_parentId' : 'parentId', $type.'s', $type === 'object' ? 'o_id' : 'id');
        $parentId = $db->fetchOne($parentIdStatement, [
            'value' => $id
        ]);

        $segments = $segmentManager->getSegmentsForElementId($parentId, $type);
        $data = array_map([$this, 'dehydrateSegment'], array_filter($segments));

        return $this->adminJson(['data' => array_values($data)]);
    }