The best way to protect against SQL injection is to use stored procedures. SQL injection is a type of attack that exploits a vulnerability in a web application that allows an attacker to inject malicious SQL commands into the input fields or parameters of the application. The attacker can then execute the SQL commands on the underlying database and access, modify, or delete the data. Stored procedures are precompiled SQL statements that are stored on the database server and can be invoked by the application. Stored procedures can prevent SQL injection by separating the SQL logic from the user input, validating the input parameters, and escaping the special characters that can alter the SQL syntax. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 424; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 8: Software Development Security, page 564]