All top frameworks support parameter binding. Same for PHP standard library like PDO or mysqli which also provide parameter binding. These eliminate SQL inject

All top frameworks support parameter binding. Same for PHP standard library like PDO or mysqli which also provide parameter binding. These eliminate SQL injection. But you have to use them and not just concatenate user input to SQL queries.