Encoded request WAF bypass, application decoding, string concatenation, input validation, parameterized query & least privilege