GHSA-rw77-vq4g-x3hp: phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

## Summary The `StopWords::add()` method in phpMyFAQ builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string **without calling the application's database escaping function** on it. A sibling method, `StopWords::update()`, which modifies an *existing* stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. …