# Always validate and sanitize
from pydantic import BaseModel, EmailStr

class UserInput(BaseModel):
    email: EmailStr
    name: str = Field(min_length=1, max_length=100)

# Never concatenate user input
# Bad
query = f"SELECT * FROM users WHERE id = {user_id}"

# Good - parameterized
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

// Never use innerHTML with user data
// Bad
element.innerHTML = userInput;

// Good
element.textContent = userInput;

# Hash passwords properly
from passlib.hash import argon2

hashed = argon2.hash(password)
verified = argon2.verify(password, hashed)