SQL injection — injecting malicious SQL through user input. OWASP Top 10 #1.
Example
WHERE name='$name' — user enters admin' OR '1'='1 — logs in as admin.
Only right way: Prepared Statements
PDO: $st->prepare(...); $st->execute([$name]).
What NOT to do
String concatenation, mysql_real_escape — outdated.
ORM
Eloquent, Doctrine — auto prepared.