Always use Prepared Statements with PDO. Never concatenate user input directly into your SQL strings. Use `?` placeholders and pass the input via `$stmt->execute([$input])`.