Escape all user supplied input

This technique should only be used as a last resort, when none of the above are feasible.
Escape user input before putting it in a query.
Each DBMS supports one or more character escaping schemes specific to certain kinds of queries.
If you then escape all user supplied input using the proper escaping scheme for the database you are using, the DBMS will not confuse that input with SQL code written by the developer, thus avoiding any possible SQL injection vulnerabilities.

Applies to

T0117 SQL injection

References

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#defense-option-4-escaping-all-user-supplied-input