# Security: SQL Injection in SQL Server "LIMIT" / "OFFSET"

DevFeed: [Security: SQL Injection in SQL Server "LIMIT" / "OFFSET"](<https://devfeed.tech/articles/security-sql-injection-in-sql-server-limit-offset-3906.md>)

Original publisher: [Read original article](<https://laravel.com/blog/security-sql-injection-in-sql-server-limit-offset>)

Author: Taylor Otwell

Published: 2021-04-28T14:45:00Z

Content type: release

Language: en

Sources: [Laravel Blog](<https://devfeed.tech/sources/laravel-blog.md>)

Topics: [Laravel](<https://devfeed.tech/topics/laravel.md>), [sql-server](<https://devfeed.tech/topics/sql-server.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [SQL](<https://devfeed.tech/topics/sql.md>)

Tags: [github](<https://devfeed.tech/tags/github.md>), [laravel](<https://devfeed.tech/tags/laravel.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [postgres](<https://devfeed.tech/tags/postgres.md>), [sql](<https://devfeed.tech/tags/sql.md>), [sql-server](<https://devfeed.tech/tags/sql-server.md>), [update](<https://devfeed.tech/tags/update.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Laravel released security patches for versions 6.20.26 and 8.40.0 to address a SQL injection vulnerability involving unfiltered user input passed to query builder methods when using Microsoft SQL Server. MySQL and Postgres were not reported as affected.

## Source excerpt

Today we have released security patches via Laravel 6.20.26 and 8.40.0. These patches resolve a security vulnerability that allowed SQL injection when unfiltered user input was passed directly to the...