This question already has an answer here:
This is far from best practice, but I just saw a piece of code that I found very interesting to say the least. The code was executing some SQL, and it was not using prepared statements so it is wide open for SQL injection.
It did however have an unorthodox approach to this. It is "secure" because all input parameters are limited to 2 characters long. And this got me thinking: is there any way an attacker can exploit this? I will of course change the code to use prepared statements, but still, I am quite curious