Replace any string-concatenated SQL with parameterized queries/prepared statements Add input validation and output escaping to prevent XSS Add CSRF protection for state-changing forms or use JWTs for ...