As per the great analysis by Manthan Surkar (@thesmallstar) in the original PR https://github.com/apache/fineract/pull/723, the cause of the FINERACT-808 bug was that "the backend would treat "UPDATE" and similar strings as SQL injection". The root cause of that was that (IMHO..) how Fineract does SQL injection is more of a workaround (blacklisting some keywords and some heuristic checks) then how this really should be done (by using JDBC Prepared statements with arguments for all external data, instead inlined SQL). This also lays the foundation for more like this in FINERACT-854.