SQL injections vulnerabilities in Stack Overflow PHP questions
It's finding some things where placeholders aren't a solution....<p>29/11/2016 08:23:13:	$update = 'UPDATE '.$table.' SET ';<p>You can't use a placeholder for a table name.  Using a dynamic table name is pretty standard practice.  The reason for that is to allow a table prefix, allowing multiple of the same app within a single database.  And, typically, the table name originates from a config file, not web POSTS/GETS or other "taintable" sources.