In reply to Sally G..

To give you some ideas, when input is received from a user via a form, the data needs to be cleaned and dangerous elements removed if they exist before using the data. The system also needs to verify that a real user has submitted the form so a check needs to be in place to ensure that via a nonce. On the other side, data pulled from the database needs to be cleaned up before sending it for display in the browser.

WPCS flags these. While these seem like no-brainer kind of things, there are plenty of plugins that don’t do these 3 simple things.

Then you add in failures to prepare database queries and the code opens you up to not just a broken site but a vulnerable site.