diff --git a/aikido_zen/vulnerabilities/sql_injection/__init__.py b/aikido_zen/vulnerabilities/sql_injection/__init__.py
index 745c8b5b6..9059c02d8 100644
--- a/aikido_zen/vulnerabilities/sql_injection/__init__.py
+++ b/aikido_zen/vulnerabilities/sql_injection/__init__.py
@@ -16,7 +16,7 @@ def detect_sql_injection(query, user_input, dialect):
     """
     try:
         query_l = query.lower()
-        userinput_l = user_input.lower()
+        userinput_l = user_input.lower().strip()
         if should_return_early(query_l, userinput_l):
             return False
 
diff --git a/aikido_zen/vulnerabilities/sql_injection/init_test.py b/aikido_zen/vulnerabilities/sql_injection/init_test.py
index f7b7a8acf..4a6c33d9c 100644
--- a/aikido_zen/vulnerabilities/sql_injection/init_test.py
+++ b/aikido_zen/vulnerabilities/sql_injection/init_test.py
@@ -413,6 +413,13 @@ def test_function_calls_as_sql_injections():
     is_sql_injection("€foobar()", "€foobar()")
 
 
+def test_trimmed_user_input_bypass():
+    is_sql_injection(
+        "INSERT INTO pets (name, owner) VALUES ('x', 'dummy'), ('injected', 'hacker'); --', 'owner')",
+        "x', 'dummy'), ('injected', 'hacker'); --    ",
+    )
+
+
 def file_paths():
     script_dir = os.path.dirname(__file__)
     return [