Защита от XSS и инъекций

$name = (string) ($_POST['name'] ?? '');
echo '<p>' . htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</p>';

$userInput = $_POST['comment'] ?? '';
$comments->save($userInput);

$bio='<script>alert(1)</script>';
echo htmlspecialchars($bio,ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8');

$value = (string) ($_GET['value'] ?? '');
echo '<input value="' . htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '">';

$email = addslashes((string) ($_GET['email'] ?? ''));
$sql = "SELECT id FROM users WHERE email = '$email'";

$sql="SELECT * FROM users WHERE email='".$_GET['email']."'";
$row=$pdo->query($sql)->fetch();

$ids = [10, 20, 30];
$placeholders = implode(',', array_fill(0, count($ids), '?'));
$stmt = $pdo->prepare("SELECT * FROM orders WHERE id IN ($placeholders)");
$stmt->execute($ids);

$columns = ['name' => 'name', 'date' => 'created_at'];
$column = $columns[$_GET['sort'] ?? 'date'] ?? $columns['date'];
$stmt = $pdo->query("SELECT id, name FROM users ORDER BY $column");

$value = (string) ($_GET['value'] ?? '');
echo '<script>const value = "' . htmlspecialchars($value, ENT_QUOTES, 'UTF-8') . '";</script>';

$data = ['name' => $name, 'role' => $role];
echo '<script type="application/json" id="page-data">';
echo json_encode($data, JSON_THROW_ON_ERROR | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
echo '</script>';

$url = (string) ($_GET['next'] ?? '');
echo '<a href="' . htmlspecialchars($url, ENT_QUOTES, 'UTF-8') . '">Продолжить</a>';

function html(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
echo '<p>' . html($user->bio) . '</p>';

$trustedHtml = $sanitizer->sanitize($editorHtml);
echo $trustedHtml->value();

final readonly class SafeHtml
{
    private function __construct(public string $value) {}
    public static function fromSanitizer(string $html, HtmlSanitizer $sanitizer): self
    {
        return new self($sanitizer->sanitize($html));
    }
}

$payload = '" autofocus onfocus="alert(1)';
echo '<input value="' . $payload . '">';

$payloads = [
    '<script>alert(1)</script>',
    '<img src=x onerror=alert(1)>',
    '<svg onload=alert(1)>',
    'javascript:alert(1)',
];

header("Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-$nonce'; object-src 'none'");

header("Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; report-uri /csp-report");