escaping.
Note that proper output encoding, escaping, and quoting is the most effective solution
for preventing SQL injection, although input validation may provide some defense-indepth. This is because it effectively limits what will appear in output. Input validation
will not always prevent SQL injection, especially if you are required to support freeform text fields that could contain arbitrary characters. For example, the name "O'Reilly"