The only proven method to prevent against SQL injection attacks while
still maintaining full application functionality is to use
parameterized queries (also known as prepared statements). When
utilising this method of querying the database, any value supplied by
the client will be handled as a string value rather than part of the
SQL query.

Additionally, when utilising parameterized queries, the
database engine will automatically check to make sure the string being
used matches that of the column. For example, the database engine will
check that the user supplied input is an integer if the database
column is configured to contain integers.