Input Sanitization Patterns

Show me how to properly sanitize user input in my [FRAMEWORK] application.

Cover these attack vectors with before/after code examples:

1. **SQL Injection**
   - Vulnerable pattern
   - Parameterized query fix
   - ORM-safe patterns

2. **XSS (Cross-Site Scripting)**
   - Stored XSS scenario
   - Reflected XSS scenario
   - Content Security Policy header
   - React's built-in protections and their limits (dangerouslySetInnerHTML)

3. **Command Injection**
   - Vulnerable pattern with child_process
   - Safe alternative

4. **Path Traversal**
   - Vulnerable file access pattern
   - Safe path resolution

5. **SSRF (Server-Side Request Forgery)**
   - Vulnerable URL fetch pattern
   - URL validation and allowlisting

For each:
- Show the vulnerable code (what NOT to do)
- Show the secure code (what TO do)
- Explain why the fix works
- Provide a test case that would catch the vulnerability

Framework-specific: use [FRAMEWORK] idioms and built-in protections where available.