Create well defined controller interfaces. Sanitize, coerce and constrain incoming parameters to safely populate data models, hold session state in URI variables across different locations, build SQL queries, apply ordering and offset/keyset pagination.