Why concatenation is the flaw — not the payload

Type anything into the input. The same value goes through both builders. Orange = characters the database will parse as SQL rather than as a name.