How do you prevent SQL Injection?

• Always use parameterized queries or prepared statements instead of string

concatenation.

Example with MySQL:

connection.query('SELECT * FROM users WHERE id = ?', [userId],

callback);

• Use ORM libraries like Sequelize which handle this automatically.
• Validate and sanitize inputs.