Unescaped variables in HTML and SQL. <p>Hello, <?= $username ?>.</p> and $sql = "update tbl set x = '{$_POST['x']}' where id = {$_POST['id']}"; For HTML

Unescaped variables in HTML and SQL. <p>Hello, <?= $username ?>.</p> and $sql = "update tbl set x = '{$_POST['x']}' where id = {$_POST['id']}"; For HTML, use htmlspecialchars, better yet a shorter wrapper function like h(), better yet a template language like Handlebars. For SQL, use parametric queries. (Most people call them parameterized queries, but with so many suffixes in English, why not choose the more musical one?)