Prepared Statements Are Not Optional

MySQLi prepared statements exist specifically so that user input can never change the shape of a SQL query. Binding parameters instead of concatenating strings means the database always treats input as data, never as code.

$stmt = $mysqli->prepare("SELECT * FROM articles WHERE slug = ? LIMIT 1");
$stmt->bind_param("s", $slug);
$stmt->execute();
$result = $stmt->get_result();

This is the pattern used throughout this codebase — every query touching request data goes through prepare() and bind_param(), without exception.