Key point
One rule
Never build SQL by joining strings with user input. Use placeholders and pass values separately.
The database driver sends the SQL shape and the user values apart. So a name, email, UPI handle, or search term stays data.
Why this matters
SQL injection happens when user input changes the meaning of your query. A login box, search box, filter, or admin route can all become risky.
Your internship repo should show that you know the safe habit. Recruiters may not run attacks, but they can read your query code.