If the parameters are used to include files, an attacker might try: ?pk=../../../../etc/passwd
This is the primary danger. If a website includes pk=1 or id=1 in the URL, it suggests the backend database query looks something like this:
The attacker uses a tool like sqlmap or manually crafts a payload to extract data: ?pk=1 UNION SELECT username, password FROM admin_users&id=1
This is the #1 way to prevent SQL injection.
The web is built of fragments. To read them well is to practice attentive, ethical discovery. The humblest query string can remind us that behind every machine-readable token there are human choices and human stories — if we look with care.