A. Use the escapeSingleQuotes() method to sanitize user input.
This method is specifically designed to prevent SOQL injection by escaping single quotes in user inputs, which are often used by attackers to close out string literals in SOQL queries and inject malicious code. By sanitizing user inputs in this way, it makes it much harder for attackers to manipulate queries.

B. Use bind variables in the SOQL query.
Bind variables are placeholders in a SOQL query that are replaced at runtime with actual values. Using bind variables not only makes queries more readable and easier to maintain but also automatically treats the values as literals, not executable parts of the query. This means that even if an input contains SOQL syntax, it would be treated as a string value rather than part of the query, thus preventing injection.