

Line 24: In SQL strings, Use
db_query() placeholders in place of variables. This is a protential source of SQL injection attacks when the variable can come from user data. (
Drupal Docs)
$sql = "SELECT * FROM {node} WHERE nid=$nid"; // unsecureExplanation: Use %s and %d variable substitution. When inserting an array of values use $placeholders = implode(',', array_fill(0, count($args), "'%s'"));