Placeholders rather than interpolation. This is the whole of SQL injection defence in PHP.
Language
Snippets written in Php
htmlspecialchars with the flags spelled out, because the defaults have changed between versions.
password_hash picks the algorithm and the salt. Never store anything a hash function can reverse.
Rotate daily link order