$sql = "select * from user where username='".$_COOKIE['username']."'";

Came across this last year... have seen variations of it over the last 15+ years, but saw it in 'new' code last summer. :/

Sad reality of rising kids with the notion that security is about forms and passwords and not about hacking stuff.