What security measures prevent SQL injection in a web application?

To prevent SQL injection in web applications, the following security measures are used:

• Use of parameterized queries (prepared statements), where parameters are passed separately from SQL code.
• Application of ORM (Object-Relational Mapping) libraries that automatically escape data.
• Validation and filtering of user input on the server side.
• Limiting database access rights to minimize damage in case of an attack.

Example of a parameterized query in C# using ADO.NET:

using (var connection = new SqlConnection(connectionString))
{
    connection.Open();
    var command = new SqlCommand("SELECT * FROM Users WHERE Username = @username", connection);
    command.Parameters.AddWithValue("@username", inputUsername);
    var reader = command.ExecuteReader();
    // process the result
}