Query built by concatenating or interpolating variables into mysqli/PDO query calls allows SQL injection.
Use parameterized queries with bound placeholders instead of building SQL from variables.