I want to highlight a topic that is not widely known: FileMaker is vulnerable to SQL injections if the FileMaker SQL functions are used without parameters. I often see examples where FileMaker fields are directly embedded into the SELECT query.
With FileMaker’s SQL commands, it is possible in some cases to query entire tables from the outside, especially if the SQL result is displayed on the layout.