What is best practice in defending against SQL injection?

Input Validation: Always validate user input to ensure it conforms to the expected format, using a whitelist approach rather than a blacklist. This can help prevent malicious data from being used in SQL queries.

Use Parameterized Queries or Prepared Statements: These techniques can ensure that user input is always treated as literal data, not part of the SQL command. This can prevent an attacker from changing the structure of the SQL command.

Use Stored Procedures: These can encapsulate the SQL statements and treat all input as parameters.

Least Privilege: Always use the least amount of database privilege necessary for a task. This can limit the potential damage of a SQL injection attack.

Error Handling: Do not reveal database error information to users, as this can provide useful information to an attacker.

Regular Updates: Keep your database management system (DBMS) and applications up-to-date to ensure you have the latest security patches.

Web Application Firewall: Use a web application firewall (WAF) to help detect and block SQL injection attacks.

Code Review and Static Analysis: Regularly review code and use static analysis tools to detect potential vulnerabilities.

Database Hardening: Follow the principle of least privilege when setting up your database. Don't use the "sa" account for web applications.

Escaping All User Supplied Input: This can help ensure that user input is not interpreted as part of the SQL command.