SQL injection
Also called SQLi, parameterised query, prepared statement
SQL is the language for asking a database for things, as in SELECT * FROM users WHERE name = 'alice'. Paste a user's text into that sentence and they can rewrite the question. A parameterised query sends the value separately, so it can only ever be a value.
One typed line can return every row or change data it should never touch. And the fix is complete, which is rare in security, so there's no reason to accept anything less.
Say it to your agent
“Use a parameterised query here and add a test that passes '; DROP TABLE users;-- as the name. The sort column can't be a parameter, so check it against an allowlist of column names.”