Summary
`AccountRepository.RemoveOldRefreshTokens` interpolates a value directly into the SQL string instead of using a query parameter, unlike the rest of the repository layer.
Details
`src/Adapters/Database/MySql/Repositories/AccountRepository.cs:382`:
```csharp
var sql = @$"DELETE FROM RefreshToken
WHERE AccountId = @accountid AND Revoked IS NULL AND Created < (CURDATE() - INTERVAL {tokenAgeInDays} DAY)";
```
Impact
Not exploitable today — `tokenAgeInDays` is type-constrained to `int` at the call site — but it's an inconsistent pattern that becomes a real SQL injection risk if ever copied for a string-typed value. Every other query in the codebase parameterizes correctly.
Suggested fix
Parameterize `tokenAgeInDays` the same way the rest of the value is (Dapper supports parameterized values inside `INTERVAL` via a computed `DATETIME` parameter, or use `DATE_SUB`/an equivalent with a bound parameter).
Summary
`AccountRepository.RemoveOldRefreshTokens` interpolates a value directly into the SQL string instead of using a query parameter, unlike the rest of the repository layer.
Details
`src/Adapters/Database/MySql/Repositories/AccountRepository.cs:382`:
```csharp
var sql = @$"DELETE FROM RefreshToken
WHERE AccountId = @accountid AND Revoked IS NULL AND Created < (CURDATE() - INTERVAL {tokenAgeInDays} DAY)";
```
Impact
Not exploitable today — `tokenAgeInDays` is type-constrained to `int` at the call site — but it's an inconsistent pattern that becomes a real SQL injection risk if ever copied for a string-typed value. Every other query in the codebase parameterizes correctly.
Suggested fix
Parameterize `tokenAgeInDays` the same way the rest of the value is (Dapper supports parameterized values inside `INTERVAL` via a computed `DATETIME` parameter, or use `DATE_SUB`/an equivalent with a bound parameter).