The query built from user input

• A

  Escape the quotes in the input before joining it

• B

  Validate that the input looks like an email address

• C

  Use a parameterised query, so the value can never be read as SQL

• D

  Restrict the database user so that any injected query cannot do real damage