Белые списки в SQL

$id_user = $_POST['user'];
$id_x = $_POST['id_x'];
$name = $_POST['name'];
    $stmt = $pdo->prepare("INSERT INTO Training (`id_user`, `id_blabla`, `name`) VALUES (:id_user, :id_x, :name)");
    $stmt->execute(['id_user' => $id_user, 'id_x' => $id_x, 'name' => $name]);

$accepted = ['id', 'username', 'created_at'];
 
$order_by = filter_input(INPUT_GET, 'order_by');
 
if (!in_array($order_by, $accepted)) {
    $order_by = $accepted[0];
}
 
$query = "SELECT id, username, created_at FROM users ORDER BY {$order_by}";

<?=$artice['title']?>

<?=htmlspecialchars($artice['title'])?>

<?=e($artice['title'])?>

printf('<a href="%s">hacked link</a>', htmlentities('javascript:alert("Hacked")', ENT_QUOTES, 'UTF-8'));

<?php htmlentities(nl2br($artice['title'], ENT_QUOTES, 'UTF-8')); ?>

printf('<a href="%s">hacked link</a>', htmlentities(nl2br('javascript:alert("Hacked")', ENT_QUOTES, 'UTF-8')));

$login = preg_replace("/[^а-яёa-z]/iu", '', $login);

$url = 'blah-blah-blah';
if (parse_url($url)[PHP_URL_SCHEME] !== 'https') {
    // throw exception ...
}

    $qwe = $_POST["qwe"]; // = "<script>alert(document.cookie)</script>" 
    $stmt = $pdo->prepare("INSERT INTO Table (`qwe`) VALUES (:blabla)");
    $stmt->execute(['blabla' => $qwe]);
...
    $stmt = $pdo->query("SELECT `qwe` FROM Table");
    $row = $stmt->fetch(\PDO::FETCH_ASSOC);
    $field= htmlentities($row["qwe"], ENT_QUOTES, 'UTF-8');
echo json_encode($field);