Everything that arrives from outside can be written by an attacker: form fields, query strings, URL parts, headers, cookies and the names of uploaded files. Injection is A05 in the OWASP Top 10:2025.
Database queries built by pasting input into a string are SQL injection (CWE-89). The fix is parameterised queries: the input is sent as data and never becomes part of the SQL.
Input echoed into a page without encoding is cross-site scripting (CWE-79): the browser runs whatever script the input contained. Encode for the place the value lands (HTML text, an attribute, a URL).
Two more that models write often: a file path built from a request parameter lets "../" walk out of the folder (path traversal, CWE-22), and a redirect to a "next" address taken from the request sends your users wherever an attacker's link says (open redirect, CWE-601).