Parameterized queries are not optional, even for the internal admin tool nobody uses

Most injection bugs are not exotic. They are a string concatenation somebody meant to come back to, and this link shows the idea.

Parameterize everything

Şu örnekte ğüşıöç İİ harfleri de doğru görünmeli. Bold text and italic text in a sentence.

$stmt = $db->prepare('SELECT * FROM users WHERE email = ? AND status = ? AND created_at > ? ORDER BY created_at DESC LIMIT 100');
$stmt->execute([$email, 'active', $since]);

Assume the input is hostile until proven otherwise.

A checklist

• Validate on the server
• Encode on output