Application Center: The principle to avoid SQL injection vulnerabilities is that all data must be filtered before entering the database, such as intval() for numeric ID and daddslashes() for string data

daddslashes()

intval()

My plug-in only has one database query, no other post get or the like