C and D is Correct
C. Use the escapeSingleQuote method to sanitize the parameter before its use:

The escapeSingleQuote method is used to sanitize user inputs that might contain special characters like single quotes ('). This is particularly useful in protecting against SOQL injection where malicious input could break the query syntax or alter the intended behavior.

D. Use variable binding and replace the dynamic query with a static SOQL:

Variable binding (also known as bind variables) is a secure method to include variables in a SOQL query. By using bind variables, the Apex runtime automatically escapes the values for you, protecting the query from injection.

CD is true
C. Use the escapeSingleQuote method to sanitize the parameter before its use.
D. Use variable binding and replace the dynamic query with a static SOQL.

Correct Answer is C & D

The answer is C & D in my view point.