6. SQL Injection Putting user input directly into a query string allows attackers to dump your database. - Fix: Use PDO prepared statements. - Why: Prepared statements treat input as data, not as part ...