What you need to know
Concatenating a search term into a query can let a crafted value change the meaning of the statement. Parameterized queries keep the command structure separate from user-provided values.
How to apply it
Use prepared statements or your database client's parameter API. For dynamic identifiers such as sort columns, allow-list the accepted names because ordinary value parameters may not apply.
Common mistake to avoid
Do not assume a frontend escaped the input. Validate for the expected shape and keep parameterization at the server's database boundary.